In the end, you need to ask yourself why you are encrypting the data. That is, what do you want to protect yourself against, and what is out of scope?

Too many unknowns to say anything with certainty. Maybe you should go back to the drawing board and find a different solution.

One idea, but I don't know if it fits,...

If you read the topic for ALTER AUTHORIZATION in Books Online, you will find this sentence: If the target entity is not a database and the entity is being transferred...

Your question is a bit open-ended, and there is not much information about your application.

But assuming that you use stored procedures to read and write data, you can use the...

You will see the Windows user name, not the group name.

What are the alternatives?

Since the user do not have SQL Server access, the application cannot impersonate them.

The application could use an SQL login, but I would definitely hold that as...

That depends. Adding to sysadmin would of course be out of the question. But if the account is only given access to the database for the application and in this...

You don't set up proxy account per user. You set up a single proxy account that all non-sysadmin users. That would be a special login that is not used for...

If you want to know the overhead of TDE, you can use (distributed) replay. That is, first capture a reasonable amout of workload with a trace. Then set up a...

If you have a 24/7 system, you have no choice but running index rebuild on the system while it is live.

But there is very much which is unclear in your...

I'm not sure that enabling TDE causes fragmentation, but I could be wrong.

If you have Enterprise Edition - and obviously you have, since you have TDE - you can use...

You can sign the procedure with a certificate. From the certificate you create a user which you grant the permissions needed.

I describe this technique in detail in an article on...

I can see two possible explanations:

1) It is not the way you think it is, but procedure and table have different owners. Check the two objects in sys.objects, and check...

Glad to see that you got it working. Permit me, however, to point out that the solution was exactly what I was telling you. 🙂

LoginUserW comes from...