Unable to move site database to SQL Always On availability group in Configuration Manager, version 2103

Applies to: Configuration Manager (current branch, version 2103)

Summary of KB10216365

After you upgrade to current branch version 2103, performing Configuration Manager site maintenance to Modify SQL Server configuration for moving the site database to an availability group fails. An error resembling the following is recorded in the ConfigMgrSetup.log file on affected site server.

Not able to decrypt using key stored in operating system.
Successfully refreshed the encrypted site master key from database.
ERROR: Failed to retrieve SQL Server certificate.
ERROR: Failed to create SQL Always On certificate.

Update information for Microsoft Endpoint Configuration Manager, version 2103

The following hotfix to resolve this problem is available for download from the Microsoft Download Center:

After you download the hotfix, see the following documentation for installation instructions:


To apply this hotfix, you must have the following:

  • Microsoft Endpoint Configuration Manager version 2103
  • KB10036164 Update rollup for Microsoft Endpoint Configuration Manager version 2103

Restart information

This update does not require a computer restart.

Additional installation information

After you install this update on a primary site, pre-existing secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site are not affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.

Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:

select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')

If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.

If the value 0 is returned, the site has not installed all the fixes that are applied to the primary site, and you should use the Recover Secondary Site option to update the secondary site.

File information

File information is available in the downloadable KB10216365_FileList.txt text file.

Release history

  • July 2, 2021: Initial hotfix release


Updates and servicing for Configuration Manager

Configure a SQL Server Always On availability group for Configuration Manager