Question: **.NET Framework Ver = 4.6.2
, Database = SQL Server 2016**

**App Type = Windows Service**

We are working on the "Always Encrypted" feature in the SQL 2016 db to perform the encryption on certain customer data columns. Our web application is built in the ASP.NET MVC architecture and is working fine with this new feature. We have copied and imported the certificate from the database server over to the IIS web-server. And the web-application is working smoothly.

But when we try to access the DB from a windows service application running on a separate server, it throws the following exception.

**Failed to decrypt column 'ColumnX'.
Failed to decrypt a column encryption key using key store provider: 'MSSQL\_CERTIFICATE\_STORE'. The last 10 bytes of the encrypted column encryption key are: '76-34-51-DA-41-8F-52-D1-A1-EE'. 
Keyset does not exist**

We have copied and imported the same certificate with the similar steps over to the server running the windows-service application.

Please suggest, if i am missing something in the certificate installation. Do we need to edit some propertied in the installed certificate ?

Answer: 
I was also facing this issue and resolved when changed user access level of account to Administrator. However running process as administrator can be a security issue,
Run MMC console and add **Local Machine** Certificate Snap-In

Search for Always Encrypted Certificate in Personal Folder, open the context menu and click Manage Private Keys.

Add the user who uses that certificate on Your DB and give him full control of that key.

[![enter image description here](https://i.stack.imgur.com/OfBhT.png)](https://i.stack.imgur.com/OfBhT.png)