update comments

Author: williamadba

backup database master keys.sql

@@ -9,17 +9,21 @@
 --		The password must be the current password for the database key. 
 --		If the password is not known, you must regenerate the password and immediately re-backup the key. Note this will force all encyrypted data to be unencrypted and re-encrypted. It is transparent but could be time-consuming.
 --		https://docs.microsoft.com/sql/t-sql/statements/alter-master-key-transact-sql follow directions to REGENERATE key with new password.
+-- See also: toolbox\backup service master key.sql
 
 exec sp_msforeachdb 'use [?];
 if exists(select * from sys.symmetric_keys )
 begin
 select ''Database key(s) found in [?]''
 select ''USE [?];''
 select ''OPEN MASTER KEY DECRYPTION BY PASSWORD = ''''passwordhere'''';   
-BACKUP MASTER KEY TO FILE = ''''c:\temp\?_''+name+''_20200131.key''''
+BACKUP MASTER KEY TO FILE = ''''c:\temp\?_''+name+''_20200131.snk''''
     ENCRYPTION BY PASSWORD = ''''passwordhere'''';
 GO  ''
 from sys.symmetric_keys;
 END';
 
---exec sp_msforeachdb 'use [?]; select ''[?]'',* from sys.symmetric_keys';
+--exec sp_msforeachdb 'use [?]; select ''[?]'',* from sys.symmetric_keys';
+
+--THEN:
+--Move the file to enterprise security vault, along with its password, associated with the SQL instance. 

lab - tde encryption workshop 2014.sql

@@ -37,8 +37,8 @@ WITH SUBJECT = 'Testing TDE Cert'
 , EXPIRY_DATE = '3/14/2071'; --Future Date
 --SELECT * FROM sys.certificates where name = 'TDECert_enctest_2012'
 GO
-BACKUP SERVICE MASTER KEY --not actually important for TDE, but important overall and should be backed up regardless.
-TO FILE = 'E:\Program Files\Microsoft SQL Server\MSSQL14.SQL2K17\MSSQL\data\SQLServiceMasterKey_20120314.smk' 
+BACKUP SERVICE MASTER KEY --not actually important for TDE, but important overall and should be backed up regardless. See also: toolbox\backup service master key.sql
+TO FILE = 'E:\Program Files\Microsoft SQL Server\MSSQL14.SQL2K17\MSSQL\data\SQLServiceMasterKey_20120314.snk' 
     ENCRYPTION BY PASSWORD = '$1234testpassword'
 
 BACKUP MASTER KEY --each instance can have its own master key.