Error: Backup failed because backup image files have not been decrypted



When you try to start a backup for a system protected by a Datto SIRIS (virtual or physical) or a Datto ALTO XL appliance, you receive the error message, "Backup failed because backup image files have not been decrypted."

In legacy versions of the Datto IRIS environment, this error message could present as "Backup failed because this encrypted agent's master key is unavailable" and "Critical backup failure: No cached master key on hand for agent."


  • Datto SIRIS
  • Datto ALTO XL
  • Datto Windows Agent
  • Datto Linux Agent
  • Datto Mac Agent
  • Agentless Backups


To ensure the security of your data, your Datto appliance does not cache your encryption key. As a result, when your device reboots, decrypted agents will automatically re-seal. This error is a result of an encrypted missing a backup because it was not unsealed by a device operator after a reboot of the Datto appliance. 


1. Access the Datto appliance.

2. Navigate to the Protect page. Sealed agents will display the notification shown in Figure 1.

Figure 1: Sealed backup agent (click to enlarge)

3. Select the Decrypt now box for the impacted agent, and enter its encryption passphrase when prompted.

4. Attempt the backup again.

Was this article helpful?

2 out of 9 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Community Forum or get live help.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Datto Homepage