How to fix Error 7860 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 7860 – Endpoint Transport/Content Cannot Be Changed via ALTER ENDPOINT

Why This Error Happens

SQL Server 2025 raises Error 7860 because certain endpoint properties—specifically the transport protocol (TCP, HTTP, etc.) or the payload type (TSQL, SOAP, SERVICEBROKER, DATABASEMIRRORING)—are immutable once the endpoint is created. The ALTER ENDPOINT statement is only designed to modify authentication, state, encryption, or listener port settings, not the fundamental transport or content type. This limitation is by design in the SQL Server engine and is not related to permissions or corruption, though insufficient privileges can sometimes mask the real issue with a misleading secondary error.

Step-by-Step Resolution Guide

Step 1: Identify the Current Endpoint Configuration

  • Run the following query to capture the full existing definition before making changes:
  SELECT name, protocol_desc, type_desc, role_desc, state_desc 
  FROM sys.database_mirroring_endpoints 
  UNION ALL 
  SELECT name, protocol_desc, type_desc, NULL, state_desc 
  FROM sys.endpoints WHERE type <> 4;
  • Note the exact PORT, AUTHENTICATION, ENCRYPTION, and ROLE values, as you will need these to recreate the endpoint identically (minus the change you want).

Step 2: Script Out and Drop the Existing Endpoint

  • Open SQL Server Management Studio (SSMS) on Windows Server 2025 and connect via an account with ALTER ANY ENDPOINT permission (typically sysadmin).
  • Execute the drop command:
  DROP ENDPOINT [Your_Endpoint_Name];
  • If the endpoint is actively used by Availability Groups or Database Mirroring, first suspend the affected sessions or failover to a secondary replica to avoid connectivity loss during the drop.

Step 3: Recreate the Endpoint with the New Transport or Content Settings

  • Use CREATE ENDPOINT with the updated parameters (e.g., changing FOR DATABASE_MIRRORING to FOR SERVICE_BROKER, or switching PROTOCOL = TCP settings):
  CREATE ENDPOINT [Your_Endpoint_Name]
  STATE = STARTED
  AS TCP (LISTENER_PORT = 5022)
  FOR DATABASE_MIRRORING (AUTHENTICATION = WINDOWS NEGOTIATE, ENCRYPTION = REQUIRED ALGORITHM AES, ROLE = ALL);
  • Ensure the LISTENER_PORT does not conflict with another active endpoint; check with netstat -ano | findstr "5022" in an elevated Windows Terminal session.

Step 4: Reassign Permissions and Grant Connect Rights

  • Since dropping an endpoint removes all associated permissions, reapply them immediately:
  GRANT CONNECT ON ENDPOINT::[Your_Endpoint_Name] TO [DOMAIN\ServiceAccount];
  • Verify Windows Firewall on Windows Server 2025 allows inbound traffic on the new port via wf.msc or New-NetFirewallRule in PowerShell.

Alternative or Verification Steps

  • Confirm the endpoint is active and correctly configured by querying sys.endpoints and sys.tcp_endpoints again, checking that state_desc returns STARTED and the port matches your intended configuration.
  • If Availability Group communication was disrupted during the drop/create cycle, verify replica health using SELECT * FROM sys.dm_hadr_availability_replica_states; and manually resume data movement if it shows SUSPENDED.