Applies to: SharePoint Server 2010

Topic Last Modified: 2010-02-19

Changes the master key of a Secure Store Service application.

Update-SPSecureStoreMasterKey -Passphrase <String> -ServiceApplicationProxy <SPServiceApplicationProxyPipeBind> [-AssignmentCollection <SPAssignmentCollection>]

The Update-SPSecureStoreApplicationServerKey cmdlet changes the master key of a Secure Store Service application.

Updating the master key is required when:

  • A new instance of a service application is created and the database for the Secure Store service application is new or empty.

  • The master key or passphrase has been compromised.

  • Security guidelines require that the passphrase or key be replaced.


Parameter Required Type Description




Specifies the passphrase that is used for the Secure Store database. The passphrase that you enter is not stored. Make sure that you write down the passphrase and store it in a secure location. The passphrase will be required to add new Secure Store service servers.




Specifies the proxy of the Secure Store service application that contains the master key to update.




Manages objects for the purpose of proper disposal. Use of objects, such as SPWeb or SPSite, can use large amounts of memory and use of these objects in Windows PowerShell scripts requires proper memory management. Using the SPAssignment object, you can assign objects to a variable and dispose of the objects after they are needed to free up memory. When SPWeb, SPSite, or SPSiteAdministration objects are used, the objects are automatically disposed of if an assignment collection or the Global parameter is not used.

When the Global parameter is used, all objects are contained in the global store. If objects are not immediately used, or disposed of by using the Stop-SPAssignment command, an out-of-memory scenario can occur.




Specifies that the database for the Secure Store service application is re-encrypted. This synchronizes the master key in all servers that run an instance of the Secure Store application.


$newPassPhrase = "abcDEF123!"
Update-SPSecureStoreMasterKey -ServiceApplicationProxy $contosoProxy -Passphrase $newPassPhrase

This example creates a new master key for the given service application.