Install TDP and migrate the MariaDB data directory

Install TDP and restore MariaDB into C:\MariaDBData after its path rules are active.

Install the TDP agent

Extract the endpoint bundle on the MariaDB host.

Open Manage computer certificates. Under Local Computer, import trust.p7b into Trusted Root Certification Authorities.

The CryptoHub REST certificate builds a valid chain to the imported trust anchor and matches the endpoint hostname.

Run installer.msi as an administrator. Keep the required TDP features selected and retain certificate and hostname validation.

Complete the installation and restart Windows when prompted.

Confirm the TDP services are running:

Get-Service FE2Policy, Futurex-TDP-PKM

Both services report Running.

Open the PKM log directory and confirm the agent fetched both C:\MariaDBData rules with the expected key group:

Get-ChildItem "$env:WINDIR\System32\config\systemprofile\AppData\Local\Futurex\TDP\Logs"

Do not initialize or restore MariaDB until the policy log contains both rules, the assigned key group, and the exact MariaDB service identity. Files written before policy is active remain clear.

Create a logical backup

The examples use MariaDB 11.4 under C:\Program Files\MariaDB 11.4. Replace that path for another installed build.

Create a logical backup while the existing server is running:

& 'C:\Program Files\MariaDB 11.4\bin\mariadb-dump.exe' `
  --user=<admin> --password `
  --all-databases --single-transaction --routines --events --triggers `
  --result-file=C:\mariadb-all.sql

Replace <admin> with a MariaDB administrative account. The command prompts for its password.

C:\mariadb-all.sql exists and the command reports no failed database objects.

The logical dump contains clear database content. Restrict its ACL and remove it after restore and verification succeed.

Initialize the protected destination

Stop MariaDB and create the destination:

Stop-Service MariaDB
New-Item -ItemType Directory -Force C:\MariaDBData

Grant the service identity full control:

icacls C:\MariaDBData /grant "NT SERVICE\MariaDB:(OI)(CI)F" /T

Replace NT SERVICE\MariaDB if sc.exe qc MariaDB reports a customized account.

Initialize MariaDB through the active TDP policy:

& 'C:\Program Files\MariaDB 11.4\bin\mariadb-install-db.exe' `
  --datadir=C:\MariaDBData --password --port=3306

The command creates C:\MariaDBData\my.ini and the MariaDB system database without errors.

Update the Windows service to use the new option file:

$service = Get-CimInstance Win32_Service | Where-Object Name -eq 'MariaDB'
$path = '"C:\Program Files\MariaDB 11.4\bin\mysqld.exe" --defaults-file="C:\MariaDBData\my.ini" MariaDB'
Invoke-CimMethod -InputObject $service -MethodName Change -Arguments @{ PathName = $path }

Start MariaDB and confirm its effective directory:

Start-Service MariaDB
& 'C:\Program Files\MariaDB 11.4\bin\mariadb.exe' `
  --user=<admin> --password `
  --batch --skip-column-names --execute='SELECT @@datadir;'

The query returns C:\MariaDBData\.

Restore the database

Restore the logical backup through the running MariaDB service:

& 'C:\Program Files\MariaDB 11.4\bin\mariadb.exe' `
  --user=<admin> --password `
  --execute='source C:/mariadb-all.sql'

The restore completes without failed objects, and the MariaDB service remains Running.

Continue to the verification procedure. Remove the logical dump securely only after the whole-tree scan, service restart, and reboot checks pass.

Do not copy the old data directory into C:\MariaDBData. TDP encrypts on write, so a copied tree can remain clear even when it is located under a path rule.

​Install the TDP agent

​Create a logical backup

​Initialize the protected destination

​Restore the database

Install the TDP agent

Create a logical backup

Initialize the protected destination

Restore the database