How to fix Error 5601 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 5601 occurs when SQL Server 2025 attempts to force-regenerate the Service Master Key (SMK) using the -F startup parameter but cannot complete the operation. This typically happens because the SQL Server service account lacks sufficient permissions on the Windows DPAPI (Data Protection API) user profile, the registry key used to store the encrypted SMK is corrupted or locked, or an underlying I/O error prevents SQL Server from writing the newly generated key back to the master database. In most cases, this is tied to a broken Windows user profile for the service account or a permissions mismatch introduced after an OS upgrade to Windows Server 2025 / Windows 11.

Step-by-Step Resolution Guide

Step 1: Verify Service Account Permissions

  • Open Services.msc and confirm the account running the SQL Server (MSSQLSERVER) service.
  • Ensure this account has Full Control on C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn.
  • Check that the account has a valid, loaded Windows user profile under C:\Users\<ServiceAccount>; a missing or corrupted profile commonly blocks DPAPI operations needed for SMK regeneration.

Step 2: Check and Repair the Windows User Profile

  • Run whoami /user while logged in as the service account (via a scheduled task or runas) to confirm the SID resolves correctly.
  • If the profile is corrupted, delete the cached profile via System Properties > Advanced > User Profiles > Settings, then restart the SQL Server service to force Windows to rebuild it.
  • Re-run SQL Server with the -F flag only after confirming the profile loads without errors in the Windows Event Viewer (Application log).

Step 3: Start SQL Server in Single-User/Minimal Mode with -F

  • Stop the SQL Server service completely via SQL Server Configuration Manager.
  • Start SQL Server manually from an elevated Command Prompt:
  sqlservr.exe -c -m -F
  • Watch the console output for the specific sub-error number referenced in the %ld placeholder — this number (e.g., Windows error 5 = Access Denied, or 1359 = Internal Error) determines whether the issue is permissions-based or disk/registry corruption.

Step 4: Validate Registry and File System Integrity

  • Open regedit and confirm the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQLServer is accessible and not flagged as read-only or orphaned.
  • Run chkdsk C: /f (schedule on next reboot if needed) to rule out file system corruption affecting the master.mdf/mastlog.ldf files.
  • Confirm there is no Group Policy or AppLocker restriction blocking DPAPI calls for the service account.

Step 5: Restart SQL Server Normally

  • Remove the -F startup parameter from SQL Server Configuration Manager once the key has been successfully regenerated.
  • Restart the SQL Server service normally and confirm it reaches a Running state without re-triggering Error 5601.

Alternative or Verification Steps

  • Run SELECT * FROM sys.symmetric_keys WHERE name = '##MS_ServiceMasterKey##'; in SSMS to confirm the SMK timestamp has updated, indicating successful regeneration.
  • If the issue persists, restore the Service Master Key from a known good backup using RESTORE SERVICE MASTER KEY FROM FILE = '<path>' DECRYPTION BY PASSWORD = '<password>' instead of forcing a regeneration.