How to fix Error 4631 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 4631 – “The permission ‘%.*ls’ is not supported in this version of SQL Server”

Why This Error Happens

This error occurs when a T-SQL script, migration file, or backup/restore operation references a permission name that has been deprecated, renamed, or not yet implemented in the specific build of SQL Server 2025 being used. It commonly arises after restoring a database from a newer or differently-versioned instance, or when running legacy scripts written for an older or incompatible SQL Server edition. Compatibility level mismatches between the source and destination server, or an incomplete Cumulative Update (CU) installation, can also trigger this permission validation failure.

Step-by-Step Resolution Guide

Step 1: Identify the Unsupported Permission and Script Source

  • Open the failing script or job in SQL Server Management Studio (SSMS) and locate the exact GRANT, DENY, or REVOKE statement referencing the permission named in the error.
  • Cross-reference the permission name against the official sys.fn_builtin_permissions system function by running: SELECT * FROM fn_builtin_permissions(DEFAULT) WHERE permission_name LIKE '%<permission>%';
  • Confirm whether the script was authored for a different SQL Server version (e.g., Azure SQL Database syntax leaking into an on-prem 2025 script).

Step 2: Verify SQL Server Build and Apply Latest Updates

  • Run SELECT @@VERSION; in a query window to confirm the exact build number of SQL Server 2025.
  • Navigate to the official Microsoft Update Catalog and download the latest Cumulative Update (CU) for SQL Server 2025 compatible with Windows Server 2025 / Windows 11.
  • Install the update via SQLServer2025-KB*****-x64.exe /quiet /IAcceptSQLServerLicenseTerms from an elevated Command Prompt, then restart the SQL Server service from services.msc.

Step 3: Correct or Remove the Unsupported Permission Statement

  • Edit the offending script and replace the deprecated permission with its current equivalent (check Microsoft’s “Permissions (Database Engine)” documentation for the 2025 mapping table).
  • If the permission was removed entirely (common with legacy ADMINISTER BULK OPERATIONS-style statements), remove the line and substitute an equivalent role membership, such as adding the user to db_datawriter or a custom server role.
  • Re-run the corrected script in a test database first: USE TestDB; GO followed by the modified GRANT/DENY statement.

Step 4: Check Database Compatibility Level

  • Run SELECT name, compatibility_level FROM sys.databases WHERE name = 'YourDatabaseName'; to check if the database is running an outdated compatibility level inherited from a restore.
  • Update it with ALTER DATABASE YourDatabaseName SET COMPATIBILITY_LEVEL = 170; (adjust the level number to match SQL Server 2025 standards).
  • Restart the SQL Server Agent service via services.msc if any scheduled jobs reference the same script.

Alternative or Verification Steps

  • Re-execute the original failing script or job after applying fixes, and confirm no Error 4631 appears in the SQL Server Error Log (EXEC xp_readerrorlog;) or Windows Event Viewer under Applications and Services Logs > MSSQLSERVER.
  • If the error persists, restore the database to a clean test instance and run DBCC CHECKDB followed by a fresh permission script generated via SSMS’s “Script Permissions As” wizard to rule out corrupted metadata.