How to fix Error 8389 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 8389 — Deprecated ALL Permission Warning

Why This Error Happens

Error 8389 is raised because the ALL permission keyword (used in legacy GRANT, DENY, or REVOKE statements) has been marked as deprecated in SQL Server 2025. This is not a failure of a security mechanism but a compatibility warning triggered when SQL Server parses a T-SQL script, stored procedure, or application login script that still uses the broad ALL permission syntax instead of granular, named permissions. The engine flags this to alert administrators that future versions of SQL Server will drop support for ALL entirely, which could break permission assignments during an upgrade if not addressed now.

Step-by-Step Resolution Guide

Step 1: Identify the Source of the Deprecated Syntax

  • Open SQL Server Management Studio (SSMS) or Azure Data Studio connected to your Windows Server 2025 instance.
  • Run the following query to check the deprecation log via Extended Events or the default trace:
  SELECT * FROM sys.fn_trace_gettable(
      (SELECT TOP 1 path FROM sys.traces WHERE is_default = 1), DEFAULT)
  WHERE EventClass = 188; -- Deprecation Announcement
  • Alternatively, search application source code, SSIS packages, and stored procedures for the string GRANT ALL, DENY ALL, or REVOKE ALL.

Step 2: Replace ALL with Explicit Permissions

  • Identify exactly which permissions the application or user actually needs (e.g., SELECT, INSERT, UPDATE, DELETE, EXECUTE).
  • Rewrite the permission statement explicitly. For example, replace:
  GRANT ALL ON dbo.Orders TO AppUser;

with:

  GRANT SELECT, INSERT, UPDATE, DELETE ON dbo.Orders TO AppUser;
  • Update any deployment scripts, DACPAC definitions, or CI/CD pipeline SQL files that reference ALL.

Step 3: Audit Server and Database Roles

  • Use sys.database_permissions and sys.server_permissions to check for any role or login still relying on the ALL keyword:
  SELECT * FROM sys.database_permissions WHERE permission_name = 'ALL';
  • Reassign affected logins to built-in fixed database roles (e.g., db_datareader, db_datawriter) or custom roles built from granular permissions instead of using ALL.

Step 4: Test in a Non-Production Environment

  • Deploy the updated scripts to a staging SQL Server 2025 instance on Windows 11 or Windows Server 2025.
  • Run application integration tests to confirm no functionality breaks due to the permission granularity change.
  • Monitor the SQL Server error log (Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG) for recurrence of Error 8389.

Alternative or Verification Steps

  • Verify the fix by re-running the deprecated feature usage query (SELECT * FROM sys.dm_os_performance_counters WHERE counter_name = 'Usage' filtered for deprecated features) and confirming no new entries appear for ALL permission.
  • If immediate code changes aren’t feasible, suppress the warning temporarily by filtering Error 8389 from alerting systems, but schedule remediation before upgrading to the next SQL Server major version, since the permission will be fully removed.