Replication Agent fails with “An error occurred during decryption.”

Share this Post

While helping a customer on a Replication issue, we encountered an very unusual error message.

There are some key words in this error (‘distributor_admin’, ‘repl_distributor’) which lead us down the path of failure in the Linked Server used by Replication Agent to connect back to the Distributor in order to update Agent status.  For testing, we tried to recreate the same linked server.  The sp_addlinkedserver command failed with the same error.  This confirms where the agent was failing, but now why.

Further investigation uncovered the SQL Agent Services was running under a Domain Account.  From the SQL Errorlog we discovered a “Service Principal Name (SPN)” could not be created.  We know the SPN is used for delegation to allow one domain user to Impersonate another domain user using Kerberos Authentication.

Our solution was to log on to the Distributor using the same Logon account as the SQL Agent and SQL Service account.  We also used the same SQL Agent Service Account across all 3 servers (publisher, distributor, subscriber) used in Replication.  While not the most secure, it did simplify authentication and allow Replication Agent to connect without unexpected errors.


Share this Post

About: ReplTalk


One thought on “Replication Agent fails with “An error occurred during decryption.””

  1. Hi Chris,

    Had the customer's Publisher/Distributor recently been moved?  

    I once encountered this same error after I had moved a Publisher/Distributor to a new machine using backup and restore with publication, msdb, distribution, and master databases using the keep_replication switch.  It turns out the Service Master Key from the old server needed to be backed up and restored on the new server to alleviate the "An error occurred during decryption" error message relating to the distributor_admin.

    Hope this helps.

Leave a Reply to Brandon Jay Williams Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.