How to fix Error 3293 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3293 – Backup/Restore to URL Initialization Failure

Why This Error Happens

Error 3293 typically occurs when SQL Server 2025 cannot establish a valid connection to the Azure Blob Storage URL specified in the BACKUP or RESTORE command. This is most commonly caused by an expired, malformed, or missing Shared Access Signature (SAS) credential, a misconfigured container URL, or outdated TLS protocols blocking the handshake between Windows Server 2025 and the Azure endpoint. In some cases, a corrupted or missing CREDENTIAL object within SQL Server itself prevents the engine from authenticating against the storage container during initialization.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Credential Object

  • Open SSMS and run SELECT * FROM sys.credentials; to confirm the credential used for the URL backup exists.
  • Ensure the credential name exactly matches the container name in your backup URL (e.g., https://<account>.blob.core.windows.net/<container>).
  • If missing or outdated, drop and recreate it:
  CREATE CREDENTIAL [https://youraccount.blob.core.windows.net/yourcontainer]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = 'your_new_sas_token';

Step 2: Regenerate and Validate the SAS Token

  • In the Azure Portal, navigate to your Storage Account > Shared access signature.
  • Confirm the token has not expired and includes Read, Write, List, Create permissions at minimum.
  • Copy the SAS token without the leading ? character, as SQL Server rejects tokens formatted incorrectly.
  • Update the credential in SQL Server using the ALTER CREDENTIAL syntax if the token was simply renewed.

Step 3: Check Network and TLS Configuration

  • On Windows Server 2025, open PowerShell as Administrator and verify TLS 1.2 (or higher) is enabled:
  Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
  • Confirm outbound port 443 is open to *.blob.core.windows.net via Windows Firewall or any corporate proxy/NSG rules.
  • Test connectivity directly using Test-NetConnection <account>.blob.core.windows.net -Port 443.

Step 4: Validate the Backup URL Syntax

  • Double-check the full URL string in your BACKUP DATABASE ... TO URL command for typos, incorrect container names, or trailing slashes.
  • Ensure the container referenced actually exists in the Azure Storage Account and is not soft-deleted.

Step 5: Restart SQL Server Services

  • After updating credentials or network settings, restart the SQL Server (MSSQLSERVER) service via services.msc or net stop MSSQLSERVER && net start MSSQLSERVER to clear cached connection states.

Alternative or Verification Steps

  • Run a test backup to a local disk path first to confirm the database itself isn’t corrupted, isolating the issue strictly to the URL connection.
  • If the error persists, use AzCopy or Azure Storage Explorer from the same Windows Server 2025 host to confirm the SAS token and network path work independently of SQL Server.