Troubleshooting Guide: Error 4611 — “To Revoke or Deny Grantable Privileges”

Why This Error Happens

Error 4611 occurs in SQL Server 2025 when an attempt is made to REVOKE or DENY a permission that was originally granted using the WITH GRANT OPTION clause, without properly accounting for the cascading effect this has on other users or roles who received the privilege downstream. SQL Server requires explicit acknowledgment (via the CASCADE option) when revoking grantable privileges because other principals may depend on that same grant chain. This typically happens when a DBA runs a simple REVOKE statement on a permission that has already been re-granted by the original recipient to additional users or roles.

Step-by-Step Resolution Guide

Step 1: Identify the Grant Chain and Affected Principals

Query sys.database_permissions to determine which permissions were granted WITH GRANT OPTION.
Run the following to check grantable permissions on a specific object:

  SELECT * FROM sys.database_permissions 
  WHERE grant_option = 1 AND major_id = OBJECT_ID('YourTableName');

Note all users/roles who may have received a secondary grant from the original grantee.

Step 2: Use the CASCADE Option When Revoking

Modify your REVOKE or DENY statement to include the CASCADE keyword, which removes the permission from the original grantee and all principals who received it downstream.
Example syntax:

  REVOKE SELECT ON dbo.YourTableName FROM UserA CASCADE;

For DENY scenarios, apply the same cascading logic:

  DENY SELECT ON dbo.YourTableName TO UserA CASCADE;

Step 3: Validate Permissions Hierarchy in SQL Server Management Studio (SSMS)

Open SSMS 21 (compatible with SQL Server 2025) and navigate to Security > Logins or Database > Security > Users.
Right-click the affected user, select Properties > Securables, and review the “Grantor” column to confirm no orphaned grants remain.
Re-run the original REVOKE/DENY command without CASCADE to confirm Error 4611 no longer appears.

Step 4: Clear Cached Permission Metadata (If Issue Persists)

Restart the SQL Server service via Services.msc on Windows Server 2025/Windows 11 to clear any stale permission cache.
Alternatively, run DBCC FREEPROCCACHE to clear cached execution plans that may reference outdated permission states.

Alternative or Verification Steps

Verify the fix by re-querying sys.database_permissions for the affected object to confirm no residual grant_option = 1 entries exist for revoked users.
If CASCADE still fails due to nested role memberships, manually revoke permissions from each downstream principal individually, starting from the lowest level in the grant hierarchy before revoking the original grantor’s permission.