How to fix Error 3279 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 3279 typically occurs when SQL Server 2025 attempts to validate or decrypt a password-protected resource—such as a database master key, a certificate-protected backup, or a linked server credential—and the stored password hash no longer matches the one being supplied. This mismatch is most commonly caused by a stale Windows credential cache, a recent Active Directory password rotation that hasn’t synced with the SQL Server service account, or a corrupted Service Master Key (SMK) that can no longer decrypt dependent objects. In some cases, Windows 11 or Windows Server 2025’s stricter NTLM/Kerberos enforcement policies also reject the authentication handshake before SQL Server even evaluates the password, triggering this access-denied state.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Service Account Credentials

  • Open SQL Server Configuration Manager and navigate to SQL Server Services.
  • Right-click the SQL Server instance, select Properties, and confirm the Log On tab shows the correct domain/local account.
  • Re-enter the password manually (even if it looks correct) and click Apply to force Windows to refresh the cached credential token.
  • Restart the SQL Server service to apply the change.

Step 2: Rebuild or Repair the Service Master Key

  • Open a new query window in SSMS connected via a sysadmin account.
  • Run the following to check SMK health:
OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourStrongPassword';
  • If this fails, restore the SMK from a known good backup:
RESTORE SERVICE MASTER KEY FROM FILE = 'C:\Backups\SMK_Backup.key'
DECRYPTION BY PASSWORD = 'OldPassword';
  • Ensure the backup file path is accessible by the SQL Server service account (check NTFS permissions on C:\Backups).

Step 3: Check Windows Credential Manager and Group Policy

  • Open Control Panel > Credential Manager on the host machine and remove any stale entries referencing the SQL Server service account.
  • Verify that Group Policy (via gpedit.msc or domain GPO) under Security Options hasn’t recently enforced “Network security: LAN Manager authentication level” changes that block NTLMv1 fallback, which Windows Server 2025 defaults to restricting.
  • Run gpupdate /force and reboot the server to apply policy changes cleanly.

Step 4: Reset the Password on the Protected Object

  • If the error points to a specific certificate or backup password (not the service account), use ALTER MASTER KEY or ALTER CERTIFICATE to reset the password:
ALTER MASTER KEY REGENERATE WITH ENCRYPTION BY PASSWORD = 'NewStrongPassword123!';
  • Document the new password immediately in your organization’s secrets vault.

Alternative or Verification Steps

  • Confirm the fix by running RESTORE VERIFYONLY against the affected backup file or re-attempting the original login/decryption operation that triggered Error 3279.
  • If the issue persists, check the SQL Server Error Log (ERRORLOG in C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\) for a more detailed stack trace, and cross-reference the Windows Security Event Log (Event ID 4625) for correlated authentication failures.