However, if you use the SQL Server Configuration Manager to change the service account, it will automatically take care of decrypting the service master key before the account change and re-encrypting it afterwards. That potentially includes entire databases, if they are protected with TDE. If you change the service account, you will not be able to access the entire encryption hierarchy anymore. (You will never have to type it again after all.) Second, only the Windows account that was executing SQL Server at the time the key was created is able to access that key. Make sure it is a very strong (and long) and truly random password. This fact has two important implications: First, your entire encryption hierarchy hinges on the strength of that very password. The service master key itself is protected by the Windows data protection API, using the password of SQL Server's service account as a key. However, upgrading an existing SQL Server installation does not change the key. Since SQL Server 2012 new service master keys are AES keys. For SQL Server version 2005 to 2008 R2 it was used with the triple DES encryption algorithm. The service master key itself is a symmetric encryption key. What is the Service Master Key and How is it Protected? If you for some reason want to force its creation, just create a linked server login or a database master key. Any time SQL Server has to protect one of those entities, it automatically creates a new service master key, if none already exists.

So, how do you create one? You do not need to create on yourself. There is not a lot of documentation about this available, but I assume that actually any kind of credential is protected by the service master key. Their passwords are encrypted using the service master key.

Another thing that actually requires the service master key is the storage of linked server login credentials. However, they can be protected with just a plain old password too. I already said that the service master key is used to protect database master keys. However, before we go there, let us look at what this mysterious thing is used for. Wait, did you not just say that you could not create the service master key yourself? Well, you can and you cannot. It cannot be used directly to encrypt data. The service master key is used to protect (encrypt) other keys, mainly the database master keys.

As such, there can only be one service master key per SQL Server instance. The Service Master Key is the root of SQL Server's Encryption Hierarchy.

Backup service master key