How to fix Error 1433 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 1433 — Database Mirroring Witness Connectivity Failure

Why This Error Happens

This error occurs when the Principal, Mirror, and Witness server instances fail to maintain a stable network connection to one another while the ALTER DATABASE SET WITNESS command is executing, often due to transient network latency or firewall interruptions on the endpoint ports. It can also be caused by the Database Mirroring endpoints not being fully started or authenticated on all three instances, or by a certificate/login mismatch preventing the Witness server from establishing a quorum with the other two partners. Additionally, Windows Server 2025 security policies may block the specific TCP port used for mirroring, causing the session to drop before the configuration change is fully committed.

Step-by-Step Resolution Guide

Step 1: Verify Endpoint Status on All Three Instances

  • Connect to the Principal, Mirror, and Witness instances individually using SSMS or sqlcmd.
  • Run the following query on each instance to ensure the endpoint state is STARTED:
  SELECT name, state_desc, port FROM sys.tcp_endpoints;
  • If the state shows STOPPED, restart it manually:
  ALTER ENDPOINT [Mirroring] STATE = STARTED;

Step 2: Check Windows Firewall and Network Connectivity

  • Ensure the specific mirroring port (commonly 5022 or a custom port) is open for inbound and outbound traffic on all three Windows Server 2025 / Windows 11 machines.
  • Use PowerShell to open the port if necessary:
  New-NetFirewallRule -DisplayName "SQL Mirroring" -Direction Inbound -LocalPort 5022 -Protocol TCP -Action Allow
  • Test raw connectivity between servers using Test-NetConnection -ComputerName <ServerName> -Port 5022 to rule out network drops.

Step 3: Validate Login Permissions and Certificates

  • Confirm that the SQL Server service accounts for all three instances have CONNECT permissions on the respective mirroring endpoints.
  • If using certificate-based authentication (common in non-domain setups), verify the certificates haven’t expired and are correctly mapped to logins on each server.
  • Re-grant connect permissions if needed:
  GRANT CONNECT ON ENDPOINT::[Mirroring] TO [Domain\ServiceAccount];

Step 4: Re-run the SET WITNESS Command

  • Once connectivity, firewall rules, and permissions are confirmed, return to the Principal server and re-issue the command.
  • Execute the following, replacing the path with your specific Witness server address:
  ALTER DATABASE [YourDatabaseName] SET WITNESS = 'TCP://WitnessServer.domain.com:5022';
  • Monitor the SQL Server Error Log immediately after execution for a confirmation message that the witness was added successfully.

Alternative or Verification Steps

  • To verify the fix, query the mirroring status using SELECT * FROM sys.database_mirroring WHERE mirroring_witness_state_desc = 'CONNECTED';. If this returns a result, the Witness is successfully attached.
  • If the error persists after retrying, remove the witness entirely (ALTER DATABASE... SET WITNESS OFF), restart the SQL Server service on the Witness node specifically, and attempt to add the witness again during a period of lower network traffic.