You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Restructure OLE DB major version differences for readability
- Add summary table at top for quick at-a-glance reference
- Break dense paragraphs into scannable subsections with comparison tables
- Add IMPORTANT callout for breaking certificate validation change
- Add clear migration steps for driver name changes
- Update See also section with consistent formatting
Addresses customer feedback about 'wall of unrelated text'
Enhance major-version-differences.md with source-verified content
- Add TLS 1.3 tip and version-specific property annotations (v19.0.0+, v19.2.0+)
- Add Registry Force Protocol Encryption section (0/1/2 values)
- Add New version 19 properties section (HostNameInCertificate, ServerCertificate)
- Add Deprecated authentication methods section (ActiveDirectoryPassword)
- Add Troubleshooting section with 4 common migration scenarios
- Add 4 connection string examples
- Add backward compatibility note (empty string defaults to Mandatory)
- Improve meta description for SEO
- Fix table formatting (MD060)
- Update date to 01/29/2026
Fix TLS 1.3 relative link path
Improve value mapping readability with table format
Improve clarity: use consistent mode names and mark default
Address community feedback: clarify driver recommendation, TrustServerCertificate myth, keyword formats
Fix accuracy: TLS 1.3 requires v19.2.0+, clarify v18 default syntax
Fix v18 default values and add installer bug note
Incorporate reviewer feedback
Move registry link into info box
Update TrustServerCertificate notes for version 19
Clarified the behavior of the TrustServerCertificate setting in version 19 and addressed an installer issue in earlier v19 driver versions.
Fix wording in major version differences documentation
Fix typo in note about TrustServerCertificate registry option
Update docs/connect/oledb/major-version-differences.md
Co-authored-by: David Engel <dengel1012@gmail.com>
description: A description of the differences between the OLE DB Driver 19 for SQL Server and the OLE DB Driver for SQL Server
3
+
description: Learn about breaking changes between OLE DB Driver 19 and version 18, including encryption defaults, property type changes, and migration steps.
4
4
author: David-Engel
5
5
ms.author: davidengel
6
-
ms.date: 05/02/2025
6
+
ms.date: 01/29/2026
7
7
ms.service: sql
8
8
ms.subservice: connectivity
9
9
ms.topic: "reference"
@@ -15,26 +15,237 @@ helpviewer_keywords:
15
15
---
16
16
# Major version differences
17
17
18
+
This article describes breaking changes between Microsoft OLE DB Driver 19 for SQL Server and earlier versions.
19
+
20
+
> [!TIP]
21
+
> **MSOLEDBSQL19** (Microsoft OLE DB Driver 19 for SQL Server) is the current recommended OLE DB driver. It supports TDS 8.0 and modern security features. Version 19.2.0+ also supports TLS 1.3. Use `Provider=MSOLEDBSQL19` in your connection strings.
| Certificate validation | Skipped when client sets `Encrypt=no`| Always evaluated when encryption occurs |
31
+
| Driver name |`MSOLEDBSQL`|`MSOLEDBSQL19`|
32
+
| CLSID |`MSOLEDBSQL_CLSID` (legacy) |`MSOLEDBSQL_CLSID` (updated in header) |
33
+
34
+
> [!WARNING]
35
+
> **ActiveDirectoryPassword authentication is deprecated.** If you're migrating from version 18 to 19 and using `Authentication=ActiveDirectoryPassword`, plan to migrate to a more secure authentication method. See [Deprecated authentication methods](#deprecated-authentication-methods) for alternatives.
36
+
18
37
## Encryption property changes
19
38
20
-
In the Microsoft OLE DB Driver 19 for SQL Server, there are changes to the `Encrypt` property/connection string keyword and certificate validation behavior.
39
+
### Encrypt property type change
40
+
41
+
The driver property `SSPROP_INIT_ENCRYPT` changes from `VT_BOOL` to `VT_BSTR`.
42
+
43
+
| Connection string | Version 18 values | Version 19 values |
|`Strict`|*(no equivalent)*| TDS 8.0 encryption; requires SQL Server 2022+ |
55
+
56
+
> [!TIP]
57
+
> Starting with version 19.2.0, TDS 8.0 connections can use TLS 1.3 when connecting to SQL Server 2022 or later. The `ServerCertificate` property was also added in this version. For more information, see [TLS 1.3 support](../../relational-databases/security/networking/tls-1-3.md).
58
+
59
+
> [!NOTE]
60
+
> For backward compatibility, version 19 accepts all version 18 values (`yes`/`no`) in addition to the new values (`Optional`/`Mandatory`/`Strict`).
61
+
62
+
### Default encryption behavior
63
+
64
+
| Version | Default | Result |
65
+
| ------- | ------- | ------ |
66
+
| 18 and earlier |`no`| Connections unencrypted by default |
67
+
| 19+ |`Mandatory`| Connections encrypted by default |
68
+
69
+
To restore version 18 behavior, add one of these to your connection string:
70
+
71
+
- Provider: `Encrypt=Optional;`
72
+
- IDataInitialize: `Use Encryption for Data=Optional;`
73
+
74
+
### Certificate validation behavior
75
+
76
+
| Scenario | Version 18 | Version 19+ |
77
+
| -------- | ---------- | ----------- |
78
+
| Client sets `Encrypt=no`, server doesn't force encryption | No validation | No validation |
79
+
| Client sets `Encrypt=no`, server forces encryption |`Trust Server Certificate`**ignored**|`Trust Server Certificate`**evaluated**|
80
+
| Client sets `Encrypt=yes`|`Trust Server Certificate` evaluated |`Trust Server Certificate` evaluated |
81
+
82
+
> [!IMPORTANT]
83
+
> Version 19 clients using default settings fail to connect when the server forces encryption and uses an untrusted certificate. Update your `Trust Server Certificate` setting or use a trusted certificate.
21
84
22
-
First, the driver property `SSPROP_INIT_ENCRYPT` changes from a `VT_BOOL` to a `VT_BSTR`. The valid values of this property are `no`/`yes`/`true`/`false`/`Optional`/`Mandatory`/`Strict`. The valid values for the provider connection string keyword `Encrypt` change from `no`/`yes` to `no`/`yes`/`true`/`false`/`Optional`/`Mandatory`/`Strict`. Similarly, for the `IDataInitialize` connection string keyword `Use Encryption for Data`, the valid values change from `true`/`false` to `no`/`yes`/`true`/`false`/`Optional`/`Mandatory`/`Strict`. The `Optional` value is synonymous with the old `no`/`false` values and the `Mandatory` value is synonymous with the old `yes`/`true` values. `Strict` is a new value added in version 19.0.0 of the OLE DB Driver for SQL Server and encrypts `PRELOGIN` packets in addition to all other communication with the server. `Strict` encryption is only supported on SQL Server endpoints that support TDS 8.0, otherwise the driver fails to connect. The OLE DB Driver 19 for SQL Server continues to support all legacy keyword values for backwards compatibility.
85
+
> [!NOTE]
86
+
> `TrustServerCertificate` was **not removed** in version 19. The option still works. Version 18 ignored this setting when `Encrypt` was set to `no`, even when the server forced encryption. Version 19 now evaluates `TrustServerCertificate` in all encrypted scenarios.
23
87
24
-
Second, the default value changes from `no`/`false` to `Mandatory`. This change means that connections are encrypted by default. Previously, the driver would encrypt connections if explicitly set by the user and/or mandated by the SQL Server when the server side property `Force Encryption` was set to `yes`. To use old default behavior, include `Encrypt=Optional;` in the provider connection string, or `Use Encryption for Data=Optional;` in the `IDataInitialize` connection string.
88
+
> [!NOTE]
89
+
> The version 19 driver, before 19.4.1, had an installer issue that could set the `TrustServerCertificate` registry option to `no` on systems that previously had v18 installed. When this occurred, the driver would use the more secure registry setting, which could make connection string options appear to have no effect. This was resolved in version 19.4.1. A fresh installation of v19 (without v18 present) always correctly defaulted the registry option to `yes`. For more information, see [Registry settings](features/registry-settings.md).
25
90
26
-
Third, the `Trust Server Certificate` option is disconnected from the `Encrypt`/`Use Encryption for Data` option. In previous versions, when `Encrypt` was `false` on the client, the `Trust Server Certificate` setting was always ignored, even if the server required encryption (the server-side `Force Encryption` setting). Starting with version 19, if either the client or the server negotiates encryption on the connection, the `Trust Server Certificate` setting is evaluated to determine whether the client validates the certificate. This behavior change causes version 19 clients that use default settings to fail to connect when the server forces encryption and uses an untrusted certificate (an insecure server configuration). Clients must change their `Trust Server Certificate` registry setting and connection option to connect to servers configured that way. For more information, see [Registry settings](features/registry-settings.md) and [Encryption and certificate validation](features/encryption-and-certificate-validation.md)
91
+
> [!TIP]
92
+
> Keyword format differs by interface:
93
+
> - Provider connection strings use no spaces: `TrustServerCertificate=yes;`
94
+
> - IDataInitialize connection strings use spaces: `Trust Server Certificate=yes;`
95
+
96
+
For more information, see [Encryption and certificate validation](features/encryption-and-certificate-validation.md).
97
+
98
+
### Registry Force Protocol Encryption
99
+
100
+
The **Force Protocol Encryption** registry setting uses numeric values that map to encryption modes:
101
+
102
+
| Registry value | Encryption mode | Description |
|`0`|`Optional`| Encryption only if server requires it |
105
+
|`1`|`Mandatory`| Encryption required |
106
+
|`2`|`Strict`| TDS 8.0 encryption |
107
+
108
+
The driver uses the most secure option between the registry setting and the connection property. For registry key locations, see [Registry settings](features/registry-settings.md).
27
109
28
110
## Driver name changes
29
111
30
-
The new Microsoft OLE DB Driver 19 for SQL Server supports side by side installation with the older Microsoft OLE DB Driver for SQL Server. To be able to differentiate the drivers, the name was changed to include the major version number. To use the new driver in an application, the user must specify the new driver name. The new driver name, along with the corresponding CLSID, is specified in the updated `msoledbsql.h` header that must be included in the project. Connections through the `IDBInitialize` interface require no further changes since `MSOLEDBSQL_CLSID` specifies the CLSID of the OLE DB Driver 19 for SQL Server. Connections through the `IDataInitialize` interface must replace the value of the `Provider` keyword with `MSOLEDBSQL19` to use the Microsoft OLE DB Driver 19 for SQL Server. In graphical user interfaces such as data link properties or linked server setup in SSMS, "Microsoft OLE DB Driver 19 for SQL Server" must be selected from the list of installed providers.
112
+
Version 19 supports side-by-side installation with version 18. The driver name includes the major version number for differentiation.
113
+
114
+
| Interface | Version 18 | Version 19 |
115
+
| --------- | ---------- | ---------- |
116
+
| Provider keyword |`MSOLEDBSQL`|`MSOLEDBSQL19`|
117
+
| CLSID constant |`MSOLEDBSQL_CLSID`|`MSOLEDBSQL_CLSID` (updated in `msoledbsql.h`) |
118
+
| UI display name | Microsoft OLE DB Driver for SQL Server | Microsoft OLE DB Driver 19 for SQL Server |
119
+
120
+
**Migration steps:**
121
+
122
+
1. Include the updated `msoledbsql.h` header in your project.
123
+
1. For `IDBInitialize`: No changes needed (CLSID updated in header).
124
+
1. For `IDataInitialize`: Change `Provider=MSOLEDBSQL` to `Provider=MSOLEDBSQL19`.
125
+
1. For UI tools (SSMS, data link properties): Select **Microsoft OLE DB Driver 19 for SQL Server**.
Version 19 introduces properties for enhanced certificate validation with `Strict` encryption mode.
156
+
157
+
### HostNameInCertificate (v19.0.0+)
158
+
159
+
Specifies the host name to validate against the server's TLS/SSL certificate. Use this property when the server name in the connection string differs from the certificate's Common Name (CN) or Subject Alternative Name (SAN).
160
+
161
+
| Interface | Property |
162
+
| --------- | -------- |
163
+
| Provider keyword |`HostNameInCertificate`|
164
+
| IDataInitialize keyword |`Host Name In Certificate`|
165
+
| OLE DB property |`SSPROP_INIT_HOST_NAME_CERTIFICATE`|
166
+
167
+
> [!NOTE]
168
+
> This property is ignored when `Trust Server Certificate` is enabled. When `Encrypt=Strict`, the certificate is always validated.
169
+
170
+
### ServerCertificate (v19.2.0+)
171
+
172
+
Specifies the path to a certificate file (PEM, DER, or CER format) for exact certificate matching. The driver compares this certificate against the server's certificate during the TLS handshake.
173
+
174
+
| Interface | Property |
175
+
| --------- | -------- |
176
+
| Provider keyword |`ServerCertificate`|
177
+
| IDataInitialize keyword |`Server Certificate`|
178
+
| OLE DB property |`SSPROP_INIT_SERVER_CERTIFICATE`|
179
+
180
+
> [!IMPORTANT]
181
+
> `ServerCertificate` can only be used when `Encrypt=Strict`. Attempting to use it with `Mandatory` or `Optional` encryption results in a connection error.
182
+
183
+
## Deprecated authentication methods
184
+
185
+
### ActiveDirectoryPassword
186
+
187
+
The `ActiveDirectoryPassword` authentication method (Microsoft Entra ID Password authentication) is deprecated. This authentication is based on the [OAuth 2.0 Resource Owner Password Credentials (ROPC) grant](/entra/identity-platform/v2-oauth-ropc), which is incompatible with multifactor authentication (MFA) and poses security risks.
188
+
189
+
> [!WARNING]
190
+
> Microsoft is moving away from this high-risk authentication flow to protect users from malicious attacks. Plan to migrate to a more secure authentication method before this option is removed. For more information, see [Planning for mandatory multifactor authentication for Azure](/entra/identity/authentication/concept-mandatory-multifactor-authentication).
0 commit comments