How To Remove Pdb Seed From Restricted Mode?

When Oracle's PDB$SEED is in restricted mode, it is almost always due to a patching issue where a patch was applied to the Container Database (CDB) but not properly propagated to the seed. The core solution involves running datapatch to synchronize the patch levels and then reopening the PDB$SEED. You cannot manually take PDB$SEED out of restricted mode with a standard ALTER PLUGGABLE DATABASE command because its OPEN_MODE is always READ ONLY. The RESTRICTED column will be set to YES if there is a pending violation that needs to be addressed.

Step 1: Confirm the restricted status and identify the cause

Before taking any action, you must confirm that PDB$SEED is in restricted mode and, most importantly, identify the underlying reason by checking for plug-in violations.

Connect to the CDB as a privileged user:

sqlplus / as sysdba

Use code with caution.

Check the status of all PDBs:

SELECT CON_ID, NAME, OPEN_MODE, RESTRICTED FROM v$pdbs;

Use code with caution.

If the output shows PDB$SEED with RESTRICTED = YES, proceed to the next step.

**Check for plug-in violations:**This is the most crucial step. It will show you exactly which patches are mismatched and causing the restricted state.

-- Connect to the CDB$ROOT
ALTER SESSION SET CONTAINER = CDB$ROOT;
-- Query the violations
SELECT CON_ID, NAME, STATUS, MESSAGE, ACTION FROM pdb_plug_in_violations WHERE status != 'RESOLVED';

Use code with caution.

The output will indicate pending patch applications, such as a PSU (Patch Set Update) that has been installed in the CDB but not yet applied to the PDBs.

Step 2: Run datapatch to resolve the violations

The datapatch utility is the standard Oracle tool for post-patching actions in a multitenant environment. Running it will apply the necessary changes to PDB$SEED and other PDBs to align their patch levels with the CDB.

**Set your environment:**Ensure your ORACLE_HOME is set correctly.

Execute the datapatch command:

$ORACLE_HOME/OPatch/datapatch

Use code with caution.

datapatch will connect to the database, detect any pending patching actions, and apply them. It will log its progress and report when it has finished successfully. In some cases, particularly in a RAC environment, you may need to run datapatch from all participating nodes.

Step 3: Reopen PDB$SEED to clear the restricted status

After a successful datapatch run, the violations are resolved, but PDB$SEED will not automatically change its restricted status until it is reopened.

Connect to the CDB as a privileged user:

sqlplus / as sysdba

Use code with caution.

Close and reopen PDB$SEED:

-- First, close the PDB$SEED
ALTER PLUGGABLE DATABASE PDB$SEED CLOSE IMMEDIATE;
-- Then, reopen it
ALTER PLUGGABLE DATABASE PDB$SEED OPEN;

Use code with caution.

This process applies the changes made by datapatch and should clear the RESTRICTED flag.

Step 4: Verify that the restricted status has been removed

Run the same v$pdbs query from Step 1 to confirm that PDB$SEED is no longer restricted.

Check the status of all PDBs:

SELECT CON_ID, NAME, OPEN_MODE, RESTRICTED FROM v$pdbs;

Use code with caution.

The output for PDB$SEED should now show RESTRICTED = NO.

**Final check for plug-in violations:**Running this query again should show no pending violations for PDB$SEED.

ALTER SESSION SET CONTAINER = CDB$ROOT;
SELECT CON_ID, NAME, STATUS, MESSAGE, ACTION FROM pdb_plug_in_violations WHERE status != 'RESOLVED';

Use code with caution.

Important considerations and troubleshooting

• PDB$SEED is READ ONLY: Remember that you can never open PDB$SEED in READ WRITE mode. It is a read-only template for creating new PDBs. Any changes to it, including patch applications, are handled automatically by Oracle's tools like datapatch and dbca.
• Don't force it: Do not attempt to force PDB$SEED out of restricted mode with ALTER PLUGGABLE DATABASE ... OPEN RESTRICTED. This is a temporary measure for other PDBs and will not resolve the underlying patch misalignment issue with PDB$SEED.
• Do not drop PDB$SEED: You cannot drop the PDB$SEED, as it is essential for the multitenant architecture. If it becomes corrupted, you must recreate it, which is a more involved process.
• Oracle RAC environments: In a Real Application Clusters (RAC) environment, you must ensure that the datapatch utility is run on all nodes to apply the patches consistently across the cluster.
• Oracle Support: If the datapatch command and reopening the PDB do not resolve the issue, particularly after a successful datapatch run, it may indicate a more complex problem. In such cases, consulting Oracle Support with a knowledge base article search (e.g., Doc ID 3045086.1 for Oracle RAC issues) is the appropriate next step.