How to fix Error 13034 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 13034 in SQL Server 2025 is triggered when the Policy-Based Management (PBM) engine cannot read or validate entries in the msdb policy store, usually due to insufficient permissions on the SQL Server Agent service account or a corrupted syspolicy_* system table. This is frequently seen after an in-place upgrade to SQL Server 2025 on Windows Server 2025, where the tightened default Group Managed Service Account (gMSA) security policies block the Agent service from writing policy execution history. In rarer cases, it stems from a mismatch between the SQL Server internal schema version and a stale msdb database restored from an older instance.

Step-by-Step Resolution Guide

Step 1: Confirm the Exact Trigger in SQL Server Logs

  • Open SQL Server Management Studio (SSMS) and connect to the instance.
  • Navigate to Management > SQL Server Logs and locate the entry tied to Error 13034.
  • Cross-reference with Windows Event Viewer > Applications and Services Logs > MSSQLSERVER for the same timestamp to confirm whether it’s a permissions or schema issue.

Step 2: Validate SQL Server Agent Service Account Permissions

  • Open Services.msc on Windows Server 2025 and confirm the SQL Server Agent is running under the correct gMSA or domain account.
  • Ensure this account has db_ssisoperator and SQLAgentOperatorRole membership in msdb.
  • Run the following in a new query window to verify role membership:
  USE msdb;
  EXEC sp_helprolemember 'PolicyAdministratorRole';
  • If the account is missing, add it:
  EXEC sp_addrolemember 'PolicyAdministratorRole', 'DOMAIN\SQLAgentServiceAccount';

Step 3: Rebuild or Repair the Policy Store Tables

  • Stop the SQL Server Agent service temporarily via Services.msc.
  • Run the PBM repair script to reset corrupted history tables:
  USE msdb;
  EXEC msdb.dbo.sp_syspolicy_reinitialize_history;
  • If the command fails or the procedure doesn’t exist (indicating deeper corruption), restore msdb from a known-good backup taken prior to the upgrade.

Step 4: Re-register the gMSA and Refresh Kerberos Tickets

  • On Windows Server 2025, open an elevated PowerShell prompt and verify the gMSA is still valid:
  Test-ADServiceAccount -Identity "SQLAgentGMSA"
  • If it returns False, re-install it:
  Install-ADServiceAccount -Identity "SQLAgentGMSA"
  • Restart the SQL Server Agent service to force a new Kerberos ticket request.

Step 5: Restart Services and Re-run the Policy Evaluation

  • Restart both the SQL Server and SQL Server Agent services from Services.msc.
  • Manually trigger a policy evaluation job from Object Explorer > Management > Policy Management to confirm Error 13034 no longer appears.

Alternative or Verification Steps

  • Run SELECT * FROM msdb.dbo.syspolicy_policy_execution_history ORDER BY start_date DESC; to confirm new entries are logging without errors.
  • If the error persists after these steps, drop and recreate the msdb Policy-Based Management schema entirely using the Enable-SqlPolicyManagement cmdlet from the SQL Server 2025 PowerShell module, then re-import any custom policies from their exported .xml definitions.