Secure Store Service Application showing status=error on CA>Manage Service Applications

Question

Running SharePoint Server 2016 with MinRole.

• I looked on Manage services on server and Secure Store Service was Started and Compliant=Yes,

• also under Manage Service Applications, Secure Store Service
  Application Proxy Status=Started,

• so only the SSS Application is showing Status=Error

and I don't know why. I was unable to find any error related to this in Event Viewer in the Server neither.No failed jobs in Jobs History. Any ideas about why is this happening and how to change the status from Error to Started?

Answer 1

SOLUTION: re-provision SSS (as Mohamed El-Qassas MVP suggested), but I discovered the following 2 prerequisites had to be met (which I was missing before):

1. Farm account has to be in the Admin group on both MinRole Servers.

2. Connect to App Server as the Farm account and run SharePoint Management Shell as Admin

   Run the cmdlets

   #As Status was stuck in Starting in Central Admin
   Get-SPServiceApplication | ?{$_ -match "Secure"}| select status #this returns Provisioning
   $sts = Get-SPServiceApplication | ?{$_ -match "Secure"}
   $sts.UnProvision() #this made Status=Stopped in Central Admin
   $sts.Provision() #this made Status=Started in Central Admin.
   

Answer 2

There are several reasons why this may have happened.

Cause: One or more of the following might be the cause:

1.The master encryption key was not generated after the Secure Store Service application was created.

2. The master encryption key was deleted.

3. The secure store database is corrupted.

You need to recreate master encryption key:

To create the master encryption key:

1. Verify that the user account that is performing this procedure is a Service Application Administrator for the instance of the Secure Store Service.

2. Click the instance of the Secure Store Service application.

3. On the ribbon, click Generate New Key.

4. On the Generate New Key page, type a passphrase string in the Pass Phrase box, and type the same string in the Confirm Pass Phrase box.

REF: https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/ee924660(v=office.14)

https://social.msdn.microsoft.com/Forums/SECURITY/en-US/835ab326-85db-41c1-9c2a-26371d1c905e/secure-store-service-unable-to-obtain-master-key?forum=appsforsharepoint