How to fix Error 13128 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 13128 — Security Descriptor Issue

Why This Error Happens

Error 13128 typically occurs when SQL Server 2025 encounters a corrupted, malformed, or inaccessible security descriptor associated with a database object, Availability Group resource, or Service Broker endpoint. This is often caused by a mismatch between the Windows Security Identifier (SID) stored in the descriptor and the current Active Directory/local account mappings, especially after a server migration, domain rename, or restore from a backup taken on a different domain. In some cases, this also stems from insufficient permissions for the SQL Server service account to read security metadata from sys.security_descriptors or the underlying NTFS permissions on system database files.

Step-by-Step Resolution Guide

Step 1: Verify Service Account Permissions

  • Open Services.msc on Windows Server 2025 and confirm the SQL Server service is running under the correct domain/service account.
  • Ensure the service account has “Full Control” on the SQL Server data directory (typically C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA).
  • Run the following in an elevated PowerShell to check current permissions:
  icacls "C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA"

Step 2: Rebuild or Refresh the Security Descriptor

  • Connect via SQL Server Management Studio (SSMS) 21 and run DBCC CHECKDB with the DATA_PURITY option to identify corrupted descriptor entries:
  DBCC CHECKDB ('YourDatabaseName') WITH DATA_PURITY;
  • If corruption is confirmed, execute sp_refresh_security_descriptor (new in SQL Server 2025) to force a rebuild of the object’s descriptor cache:
  EXEC sys.sp_refresh_security_descriptor @object_name = 'dbo.YourObject';

Step 3: Resynchronize Orphaned SIDs

  • Run sp_change_users_login or the newer ALTER USER ... WITH LOGIN syntax to remap orphaned SIDs between the Windows login and the SQL Server database user.
  • Example fix command:
  ALTER USER [YourUser] WITH LOGIN = [DOMAIN\YourUser];
  • Restart the SQL Server (MSSQLSERVER) service to flush the cached security token.

Step 4: Check Group Policy and Local Security Policy

  • On Windows Server 2025, open secpol.msc and verify the “Access this computer from the network” policy includes the SQL Server service account.
  • Confirm there are no conflicting Group Policy Objects (GPOs) pushing restrictive descriptor templates via Group Policy Management Console (GPMC).

Alternative or Verification Steps

  • To verify the fix, re-run DBCC CHECKDB and confirm no errors reference 13128 or security descriptor mismatches in the output.
  • If the issue persists, restore the affected database to a point before the domain change/migration using RESTORE DATABASE ... WITH REPLACE, then reapply transaction logs to bring it current while rebuilding permissions from scratch.