Skip to main content
Deploy a MariaDB Disk Protection service and authorize the Windows service identity for the complete protected data directory.
1
Log in to CryptoHub under dual control with your administrator identities.
2
Open the service catalog, select MariaDB, and select Deploy.
3
Configure Service Setup:
  • Enter a Service Name that identifies this MariaDB deployment.
  • Keep the default Service Category.
  • Select Next.
4
Configure Access Control:
  • Confirm the administrator role appears under Authorized Resources.
  • Add other roles or identities that must administer this service.
  • Select Next.
5
Select Local authentication, then select Next.
The wizard advances to Path Rules with Local authentication selected.
6
Add a path rule for files directly under the new data directory:
  • Path: C:\MariaDBData\*
  • Users: NT SERVICE\MariaDB
  • Key group: select the key group that protects this deployment.
Enter the service identity under Users, not Groups. If sc.exe qc MariaDB reports another service account, enter that exact account instead.
7
Add a second path rule for all subdirectories:
  • Path: C:\MariaDBData\**
  • Users: the same MariaDB service identity
  • Key group: the same key group
The rule list contains both paths, the exact MariaDB service identity, and an assigned key group.
8
Select Deploy.
CryptoHub opens the deployed MariaDB service and displays its endpoint and path-rule management surfaces.
Do not point the rules at the existing in-use data directory and assume its files are protected. TDP applies policy only when an authorized process writes a file. The installation procedure restores MariaDB into the new directory after the policy is active.