# Duplicati won't accept server DB encryption key after upgrade to 2.2.0.0\_stable

**URL:** <https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553>\
**Category:** Support\
**Created:** [November 5, 2025, 3:21pm UTC](https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553 "2025-11-05T15:21:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![redusr](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/r/bcef8e/32.png) [@redusr](https://forum.duplicati.com/u/redusr)\
**Post date:** [November 5, 2025, 3:21pm UTC](https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553/1 "2025-11-05T15:21:19Z")

</div>

I use Duplicati with a server DB encryption key setup with Windows Credentials Manager on a Win11x64 machine.

This has worked well with `2.1.0.5_stable_2025-03-04` but after upgrading to `2.2.0.0_stable_2025-10-23` today, the key seems not to be accepted anymore. That is, when starting the `Duplicati.GUI.TrayIcon.exe` , it crashes immediately and following error message is logged:

```plaintext
Application: Duplicati.GUI.TrayIcon.exe
CoreCLR Version: 8.0.2025.41914
.NET Version: 8.0.20
Description: The process was terminated due to an unhandled exception.
Exception Info: Duplicati.Library.Interface.UserInformationException: Server crashed on startup
 ---> System.Exception: A serious error occurred in Duplicati: Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
   at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
   at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
   at Duplicati.Server.Database.Connection.<>c __DisplayClass37_0.<GetSettings>b__ 0(IDataReader rd)
   at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func`2 f)+MoveNext()
   at System.Collections.Generic.LargeArrayBuilder`1.AddRange(IEnumerable`1 items)
   at System.Collections.Generic.EnumerableHelpers.ToArray[T](IEnumerable`1 source)
   at Duplicati.Server.Database.Connection.ReadFromDb[T](Func`2 f, Action`1 prep)
   at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
   at Duplicati.Server.Database.ServerSettings.ReloadSettings()
   at Duplicati.Server.Database.ServerSettings..ctor(Connection con, Action startOrStopUsageReporter)
   at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
   at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary`2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
   at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args)
 ---> Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
   at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
   at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
   at Duplicati.Server.Database.Connection.<>c __DisplayClass37_0.<GetSettings>b__ 0(IDataReader rd)
   at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func`2 f)+MoveNext()
   at System.Collections.Generic.LargeArrayBuilder`1.AddRange(IEnumerable`1 items)
   at System.Collections.Generic.EnumerableHelpers.ToArray[T](IEnumerable`1 source)
   at Duplicati.Server.Database.Connection.ReadFromDb[T](Func`2 f, Action`1 prep)
   at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
   at Duplicati.Server.Database.ServerSettings.ReloadSettings()
   at Duplicati.Server.Database.ServerSettings..ctor(Connection con, Action startOrStopUsageReporter)
   at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
   at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary`2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
   at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args)
   --- End of inner exception stack trace ---
   at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args)
   at Duplicati.GUI.TrayIcon.HostedInstanceKeeper.<>c __DisplayClass5_0.<.ctor>b__ 0(Object _)
   --- End of inner exception stack trace ---
   at Duplicati.GUI.TrayIcon.HostedInstanceKeeper..ctor(IApplicationSettings applicationSettings, String[] args)
   at Duplicati.GUI.TrayIcon.Program.Main(String[] _args)
   at Duplicati.GUI.TrayIcon.Net8.Program.<>c __DisplayClass0_0.<Main>b__ 0()
   at Duplicati.Library.Crashlog.CrashlogHelper.WrapWithCrashLog[T](Func`1 method)
   at Duplicati.GUI.TrayIcon.Net8.Program.Main(String[] args)

```

The command-line test is still successful anyways:

```plaintext
C:\Program Files\Duplicati 2>Duplicati.CommandLine.SecretTool.exe test wincred:// duplicati-server
NOTE: Secret values are not displayed for security reasons
Secrets:
- duplicati-server: Found!

```

I looked for similar posts in the forum and voila - there was one promising similarity in a thread I had started months ago:

> [@Setup Server DB encryption with Windows Credential Manager](https://forum.duplicati.com/t/setup-server-db-encryption-with-windows-credential-manager/20232/12):
>
> I tested with this exact setup, and I found the problem. The secret matcher does not currently support - in the key name, so you need the key to be: --settings-encryption-key=$duplicatiserver This means you have to rename the key in the Windows Credential manager as well. I will update the code to support - and \_, but I am thinking of how to catch similar cases as well. Alternative is to provide a pattern, like: --secret-provider-pattern=$() --settings-encryption-key=$(duplicati-server)

I wouldn’t have expected such a behavior change from `2.1.0.5_stable_2025-03-04` to `2.2.0.0_stable_2025-10-23` but adjusted my setup:

- I changed the entry in Windows Credential Manager from `duplicati-server` to `duplicatiserver`
- I modified the command-line parameters from `“C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe” --secret-provider=wincred:// --settings-encryption-key=$duplicati-server` to `“C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe” --secret-provider=wincred:// --settings-encryption-key=$duplicatiserver`

The command-line test is successful:

```plaintext
C:\Program Files\Duplicati 2>Duplicati.CommandLine.SecretTool.exe test wincred:// duplicatiserver
NOTE: Secret values are not displayed for security reasons
Secrets:
- duplicatiserver: Found!

```

But Duplicati still crashes with the same error message, meaning I cannot use it at all.

Did I miss updating any required property after upgrade?

---

<div class="post-metadata">

**Author:** ![kenkendk](https://forum.duplicati.com/user_avatar/forum.duplicati.com/kenkendk/32/5305_2.png) [@kenkendk](https://forum.duplicati.com/u/kenkendk)\
**Post date:** [November 5, 2025, 5:46pm UTC](https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553/2 "2025-11-05T17:46:45Z")

</div>

> [@redusr](#):
>
> But Duplicati still crashes with the same error message, meaning I cannot use it at all.
> 
> Did I miss updating any required property after upgrade?

No special action should be needed.

What I think is the issue is that 2.1.0.5 could not detect the `$duplicati-server` as a token, so it used it literal, and now that it does get parsed, nothing works.

If I am correct, you should be able to decrypt, and then re-encrypt.

1. Decrypt

```plaintext
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe” --settings-encryption-key=$duplicati-server --disable-db-encryption

```

This should start up correctly, and now the database is decrypted.

1. Stop Duplicati, then start it with the right key:

```plaintext
“C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe” --secret-provider=wincred:// --settings-encryption-key=$duplicati-server

```

Duplicati should now encrypt the database using the correct key.

---

<div class="post-metadata">

**Author:** ![redusr](https://forum.duplicati.com/letter_avatar_proxy/v4/letter/r/bcef8e/32.png) [@redusr](https://forum.duplicati.com/u/redusr)\
**Post date:** [November 6, 2025, 12:31pm UTC](https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553/3 "2025-11-06T12:31:35Z")

</div>

Looks like you were right, I followed your instructions and everything is working now. Thanks for your help!

The only thing I do not really understand is the command-line behavior when starting the server from there. I usually have a desktop shortcut with the additional parameters, so I never see the command-line interface. When I had done the Decrypt-step of your instructions in command-line, I quit Duplicati using the Tray Icon (not with `CTRL+C` in the command-line) to be safe that it does not exit before finishing the decryption. I would have expected the command-line to reflect the process stop but after `Duplicati.GUI.TrayIcon.exe` disappeared from Task Manager processes, the command-line looked still busy:

![image](https://forum.duplicati.com/uploads/default/original/2X/7/72e085b915f855fdfc3580716a395cc97de5bd94.png)

I don’t know whether that is Duplicati-specific and it seems like it did not harm anything, just wanted to let you know because the behavior was confusing me.

---

<div class="post-metadata">

**Author:** ![kenkendk](https://forum.duplicati.com/user_avatar/forum.duplicati.com/kenkendk/32/5305_2.png) [@kenkendk](https://forum.duplicati.com/u/kenkendk)\
**Post date:** [November 7, 2025, 3:02pm UTC](https://forum.duplicati.com/t/duplicati-wont-accept-server-db-encryption-key-after-upgrade-to-2-2-0-0-stable/21553/4 "2025-11-07T15:02:31Z")

</div>

> [@redusr](#):
>
> I don’t know whether that is Duplicati-specific and it seems like it did not harm anything, just wanted to let you know because the behavior was confusing me.

This is a Windows quirk. For Windows, it has different types of executables.  
Executables that show a UI will be launched and then return to the commandline, unlike other commands who will remain running and then only return to the commandline once they are done.

The TrayIcon shows a UI (even though it is small) so it has to be a UI executable, otherwise Windows will show a commandline window every time you launch it.

What we have done with the TrayIcon is attach the output to the console that launches it (when possible) so you can see the output, but it looks quite weird.