How to fix Error 3068 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3068 – Invalid File Snapshot URL

Why This Error Happens

Error 3068 typically occurs when SQL Server 2025 attempts to access a file snapshot (commonly used in BACKUP/RESTORE operations with Azure Blob Storage or local snapshot-based backups) using a URL that is malformed, incomplete, or points to an inaccessible endpoint. This can result from incorrect syntax in the WITH URL clause, expired or invalid SAS (Shared Access Signature) tokens, or a mismatch between the credential configured in SQL Server and the actual storage container path. Additionally, corrupted metadata in the backup history tables or a broken Credential object in SQL Server can trigger this error even when the URL appears syntactically correct.

Step-by-Step Resolution Guide

Step 1: Validate the URL Syntax and Structure

  • Open SQL Server Management Studio (SSMS) and review the exact BACKUP DATABASE or RESTORE command being executed.
  • Ensure the URL follows the correct format: https://<storageaccount>.blob.core.windows.net/<container>/<blobname>.bak.
  • Check for trailing slashes, double slashes, or missing container names — these are the most common causes of malformed URLs.
  • Confirm there are no unescaped special characters (such as spaces or &) in the blob name.

Step 2: Verify the SQL Server Credential Object

  • Run the following query to inspect existing credentials:
  SELECT name, credential_identity FROM sys.credentials;
  • Ensure the credential name matches exactly with the container name referenced in the URL (case-sensitive on some storage backends).
  • If using a SAS token, confirm it has not expired by checking the se= (expiry) parameter in the token string.
  • Recreate the credential if necessary:
  CREATE CREDENTIAL [https://<storageaccount>.blob.core.windows.net/<container>]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = '<your_updated_sas_token>';

Step 3: Test Network and Storage Endpoint Connectivity

  • From the Windows Server 2025 / Windows 11 host, open PowerShell and test connectivity to the storage endpoint:
  Test-NetConnection -ComputerName <storageaccount>.blob.core.windows.net -Port 443
  • Confirm that outbound HTTPS traffic is not blocked by Windows Firewall or a corporate proxy.
  • Check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > SQLServer for any TLS handshake failures tied to the snapshot request.

Step 4: Clear Cached Backup Metadata and Retry

  • If the URL and credentials are confirmed valid but the error persists, clear any stale backup history that may reference the broken snapshot URL:
  EXEC msdb.dbo.sp_delete_backuphistory @oldest_date = GETDATE();
  • Restart the SQL Server service via services.msc or run:
  Restart-Service -Name MSSQLSERVER -Force
  • Re-issue the original BACKUP or RESTORE command to confirm the URL resolves correctly.

Alternative or Verification Steps

  • To verify the fix, run a test backup to the same URL using BACKUP DATABASE <TestDB> TO URL = '<validated_url>' and confirm it completes without Error 3068.
  • As an alternative, bypass cloud snapshot backups temporarily by redirecting the backup target to a local or UNC path (e.g., \\fileserver\backups\) to isolate whether the issue is specific to the URL/credential chain or a broader SQL Server configuration problem.