---
title: "Create a Microsoft SQL Server Database for Lasernet Keep"
slug: "create-a-microsoft-sql-server-database-for-keep"
description: "This page provides manual and SQL command methods for creating and configuring a Microsoft SQL Server database for Keep."
tags: ["Keep", "SQL"]
updated: 2026-07-03T13:34:56Z
published: 2026-07-03T13:34:56Z
canonical: "kb.lasernetgroup.com/create-a-microsoft-sql-server-database-for-keep"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.lasernetgroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Microsoft SQL Server Database for Lasernet Keep

This page describes how to create a Microsoft SQL Server database for Keep to use.

In summary, the process has the following stages:

1. Create the database.
2. Create the database user (that Keep will connect to the database as).
3. Assign database roles to the user.

You can create the database and user manually (through various windows in SQL Server Management Studio). Or, if you prefer, you can run a SQL script.

## Before You Begin

1. Ensure that the Microsoft SQL Server instance where you want to host the Keep database is up and running.

> [!WARNING]
> Important
> 
> The SQL Server instance must have [TCP/IP enabled, using the correct TCP port](/v1/docs/create-a-microsoft-sql-server-database-for-keep#tcpip-is-not-enabled). If your SQL Server instance does not already host a Keep database, or a database for other software that requires the same configuration, you must appropriately configure the instance.
2. Start SQL Server Management Studio.
3. Connect your SQL Server instance with a user account that can create databases and users.

You can now follow the [manual method](/v1/docs/create-a-microsoft-sql-server-database-for-keep#manual-method) or the [SQL command method](/v1/docs/create-a-microsoft-sql-server-database-for-keep#sql-command-method) for creating the Keep database and user.

## Manual Method

The following sections describe how to manually create the database and user.

### Manually Create the Database

To create the database, follow these steps:

1. Start Microsoft SQL Server Management Studio and connect to the relevant instance.
2. In the **Object Explorer** pane, right-click **Databases**, then select **New Database**. The **New Database** window opens.

![The New Database menu option in the Object Explorer pane](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/new database.png)
3. On the **General** page, enter a **Database name** for the new database. The Keep installer assumes that the database name is `AFPDM`, so enter **AFPDM** (unless you want to give the database a different name). If you do use a different name, ensure that you enter that same name when you later install Keep.
4. Click **OK**.

### Manually Create the Database User for Keep

To create the database user, follow these steps:

1. In the **Object Explorer** pane, expand **Security**.
2. Right-click **Logins**, then select **New Login**. The **Login - New** window opens.

![New login menu item in the Object Explorer pane](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/new login.png)
3. Select the **General** page, then configure the new user:
  1. Enter a **Login name**. The default name used by the Keep installer is `pdm`. Unless you want to use a different name (see warning below), enter **pdm**.
  2. Click **SQL Server authentication**.
  3. Enter a password into **Password** and **Confirm Password**. The default password used by the Keep installer is `pdm`. Unless you want to use a different password (see warning below), enter **pdm**.

> [!WARNING]
> Warning
> 
> If you enter a **Login name** or **Password** other than the default `pdm` (for example, to mitigate any security risks around using the default credentials), ensure that you enter those same credentials later in the Keep installer. It is strongly advised that you use a strong password (instead of the default `pdm`). Password policy features in SQL Server are also available to you in this window. However, you must not select **User must change password at next login**.
  4. In the **Default database** list, select the database that you created. For example, **AFPDM**.

![General page for new login](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/login new - general.png)
4. Select the **Server Roles** page, then select the **public** checkbox.

![Server roles page for new login](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/login new - server roles.png)
5. Select the **User Mappings** page, then configure the new user:
  1. In the upper table, click the **AFPDM** row.
  2. In that row, select the **Map** checkbox.
  3. Ensure that the **AFPDM** row is still selected. Then, select the following checkboxes in the lower part of the window:

![New user mapping for new login](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/login new - user mapping.png)
    - **db_ddladmin**
    - **db_datareader**
    - **db_datawriter**
6. Click **OK** to create the user.

## SQL Command Method

To use SQL commands to create the database and user (instead of the manual method described above), run the following SQL script in SQL Server Management Studio.

> [!WARNING]
> Warning
> 
> In the SQL commands, you must make the following substitutions:
> 
> 
> 
> Substitute `<databasename>` for the database name that you want to use. For example:
> 
> - `SET @DatabaseName = '<databasename>';` becomes `SET @DatabaseName = 'AFPDM';`
> 
> Substitute `<username>` for the user name that you want to use. For example:
> 
> - `SET @Username = '<username>';` becomes `SET @Username = 'pdm';`
> 
> Substitute `<password>` for the password that you want to use. For example:
> 
> - `SET @Password = '<password>';` becomes `SET @Password = 'YourSecurePassword';`

> [!WARNING]
> Warning
> 
> Your system might be configured with a password complexity policy that causes SQL Server to reject your chosen password. If you run the script but the **Messages** pane contains an error related to password validation, you must change the password in the script so that it complies with SQL Server password complexity rules, then run the updated script.

SQL script:

```plaintext
DECLARE @DatabaseName VARCHAR(50);
DECLARE @Username NVARCHAR(50);
DECLARE @Password NVARCHAR(50);
 
SET @DatabaseName = '<databasename>';
SET @Username = '<username>';
SET @Password = '<password>';  -- Ensure you set a secure password here
 
DECLARE @SQL NVARCHAR(MAX);
 
-- Create database if it does not exist
IF NOT EXISTS (SELECT name FROM sys.databases WHERE name = @DatabaseName)
BEGIN
    SET @SQL = 'CREATE DATABASE [' + @DatabaseName + ']';
    EXEC sp_executesql @SQL;
END
 
-- Create login if it does not exist
IF NOT EXISTS (SELECT name FROM sys.server_principals WHERE name = @Username)
BEGIN
    SET @SQL = 'CREATE LOGIN [' + @Username + '] WITH PASSWORD = ''' + @Password + ''', DEFAULT_DATABASE = [' + @DatabaseName + ']';
    EXEC sp_executesql @SQL;
END
 
-- Create user mapped onto database and assign appropriate roles if user does not exist
SET @SQL = 'USE [' + @DatabaseName + ']; ' +
           'IF NOT EXISTS (SELECT name FROM sys.database_principals WHERE name = ''' + @Username + ''') ' +
           'BEGIN ' +
           'CREATE USER [' + @Username + '] FOR LOGIN [' + @Username + ']; ' +
           'EXEC sp_addrolemember ''db_ddladmin'', ''' + @Username + '''; ' +
           'EXEC sp_addrolemember ''db_datareader'', ''' + @Username + '''; ' +
           'EXEC sp_addrolemember ''db_datawriter'', ''' + @Username + '''; ' +
           'END';
EXEC sp_executesql @SQL;
```

## Troubleshooting

In some circumstances, Keep cannot log in to its database. The following information might help you resolve the issue.

### TCP/IP Is Not Enabled

If TCP/IP is not enabled for the SQL Server instance and the TCP port is not correctly set, Keep will fail to start.

To fix this issue, follow these steps:

1. Start SQL Server Configuration Manager.
2. Navigate to **SQL Server Network Configuration** > **Protocols for <SQL Server instance for Keep>**. Appropriately substitute **<SQL Server instance for Keep>**.
3. In the main area of the SQL Server Configuration Manager window, double-click **TCP/IP**.

![A screenshot of SQL Server Configuration Manager with rectangles indicating the position of the TCP/IP protocol row and the IPAll config.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/sql server configuration manager.png)
4. In the **TCP/IP Properties** window:
  1. On the **Protocol** tab, set **Enabled** to **Yes**.
  2. On the **IP Addresses** tab, scroll down to the **IPAll** area and set **TCP Port** to **1433**.
  3. Click **OK**.
5. Restart the SQL Server Windows service for the relevant SQL Server instance.

![Red rectangles indicate the position of the SQL Server service and its stop and start controls in the SQL Server Configuration Manager.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/restart sql server service.png)
6. Restart the Windows service for Keep. This step is required only if Keep is already installed and failed to start.

### Incorrectly Assigned User Roles

If user roles have been incorrectly assigned, Keep will write failure messages to its logs in particular situations:

- When Keep starts for the first time (as a new installation or after an upgrade)
  - Failure messages related to logging into the database.
  - Failure messages related to creating tables and database objects.
- During administrative operations such as adding or removing key definitions
  - Failure messages related to modifying the `tblDocuments` or `tblDocumentHistory` tables.

If you see these messages in the logs, check that users have been created and that they have the correct role assignments:

1. In the **Object Explorer** pane, expand **Databases**, then expand the new database.
2. Expand **Security** > **Users**, right-click the new user (**pdm**), then select **Properties** from the menu. The **Database User - pdm** window opens.

![Users in Object Explorer](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/users in object explorer.png)
3. On the **General** page, check that **Default schema** is **dbo**. This is the correct setting for a standard setup of Keep.
4. On the **Membership** page, check that the following role checkboxes are selected:
  - **db_ddladmin**
  - **db_datareader**
  - **db_datawriter**