KB #240136: NetLib Key Management Service (nlcbtask) does not start but starts manually

Type:

Workaround

Summary:

Encrypted databases may be inaccessible after reboot (listed as Suspect or Recovery Pending). If the Master Database is encrypted, SQL Server will not even start at reboot. The NetLib Encryptionizer Key Management Service (KMS, nlcbtask) has not started after reboot but can be started manually. This is not a common issue, but is related to when the NetLib KMS is configured with a service startup logon, which you may have done if you secured a service with a remote profile. If the start-up logon for the KMS (nlcbtask) is Local System, then this article will not resolve your issue.

Additional Information:

If you have a remote profile, and have set the Startup Logon for the NetLib KMS to be a setting other than Local System Account (see also KB #240119), this logon needs to be accessible when windows performs service start-ups. In some rare instances, the NetLib KMS is called to start by Windows before the Windows Network service start-ups are completed. If Windows Network services are not up and running, then the NetLib KMS will not start, even when set to Automatic. No errors are found.  However, if you later start the NetLib KMS, it starts successfully because the Windows Network services are fully up and running by then.
Our recommended workaround:

• Set the NetLib Key Management Service (NLBCTASK) to be dependent upon some of the Windows networking services (NLASVC) and one of our other services that is not dependent on networking services (we will show you how below)
• Set the secured SQL Server Service to be dependent upon the NetLib Key Management Services (instructions to follow) rather than just Automatic (Delayed).

We recommend that you use this method only on machines where you are experiencing this issue. It is not harmful, but is not standard so a software update may overwrite these entries and would need to be applied again.

In order to apply the fix, please do the following:

• Create a Windows System Restore Point, backup the registry or machine snapshot if this is a virtual machine before making any changes.
• Using Notepad, create a file named NLUpdateDependencies.REG on your desktop and copy/paste the text below into it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNLCBTASK]
"DependOnService"=hex(7):4e,00,4c,00,43,00,42,00,48,00,45,00,4c,00,50,00,00,00,4e,00,4c,00,41,00,53,00,56,00,43,00,00,00,00,00
"Group"=-
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesMSSQL$MYSERVER]
"DependOnService"=hex(7):4e,00,4c,00,43,00,42,00,54,00,41,00,53,00,4b,00,00,00,00,00

• Modify the BLUE letters with the name of your secured SQL Service. If you have more than one secured instance, repeat the last two lines and adjust the SQL instance name.
• Save the file.
• Import the file into the registry with REGEDIT.EXE
• Reboot the server.
• NetLib Key Management Service (NLCBTASK) will start after successful start of Windows service NLASVC (Network Location Awareness Service Provider). The secured SQL  instances will wait until a successful start of the NetLib Services.

Related Topics:

240119: Encrypted Databases Not Accessible After Reboot but are Accessible After Manually Restarting SQL Server

240102: Encrypted Databases not accessible (Recovery Pending, Suspect)

240085: SQL will not start – related articles

240086: fn_n_keycount() returns Zero, when greater than Zero expected