Confirm the active data directory
1
Confirm MariaDB and the TDP services are running:
All three services report Running.
2
Query the effective data directory:Replace
<admin> with a MariaDB administrative account. The command prompts for its password.The query returns
C:\MariaDBData\.Perform a database round trip
Run the following SQL through a MariaDB client:The query returns
protected by CryptoHub TDP and a payload length of 1048576.Verify every regular file
Runfuturex-tdp-is-encrypted.exe against every file under the active data directory. The tool can write its Boolean result to a stream that some PowerShell versions classify as native-command error output, so use System.Diagnostics.Process instead of $LASTEXITCODE.
The scan reports
clear=0 and indeterminate=0. Resolve every exception before treating the deployment as protected.Verify restart and reboot persistence
1
Restart MariaDB:
MariaDB returns to Running.
2
Repeat the marker query and confirm the row is readable.
3
Restart Windows. Confirm
MariaDB, Futurex-TDP-PKM, and FE2Policy return to Running.4
Repeat the marker query, write another row, and rerun the whole-tree encryption scan.
The original marker remains readable, the new row succeeds, and the scan still reports
clear=0 and indeterminate=0.5
After every check passes, securely remove the temporary logical dump according to your organization’s data-handling policy.
Troubleshooting
Access is deniedor MariaDB cannot open files: comparesc.exe qc MariaDBwith the user on both path rules and the ACL onC:\MariaDBData. All three must name the same service identity.- The scan reports the entire tree as clear: confirm the PKM log contains both path rules and the assigned key group. Reinitialize and logically restore the destination only after policy is active.
- Only manually created files are clear: identify the account that created them. An account absent from the path rule is expected to write clear files.
- Old files remain clear after adding a rule: do not copy them into the protected directory. Restore a logical backup through the MariaDB service so the authorized identity rewrites them.
- A policy change does not appear in the PKM log: restart
Futurex-TDP-PKM, wait for the refreshed rules, and rerun verification before writing protected data.

