How to fix Error 3295 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3295 — Backup To URL Exclusive Access Failure

Why This Error Happens

Error 3295 occurs when SQL Server 2025 cannot obtain exclusive access to the blob file at the destination URL because another process, session, or backup operation currently holds a lock on it. This is commonly caused by a previous backup job that did not terminate cleanly, a concurrent backup/restore operation targeting the same blob, or stale lease metadata left behind by Azure Blob Storage after an interrupted connection. In some cases, corrupted credential objects or expired Shared Access Signature (SAS) tokens can also cause SQL Server to retry against a file it believes is still locked.

Step-by-Step Resolution Guide

Step 1: Identify and Terminate Conflicting Sessions

  • Open SQL Server Management Studio (SSMS) and run sp_who2 or query sys.dm_exec_requests to check for any active backup/restore tasks referencing the same URL.
  • If a stale session is found, terminate it using KILL <session_id>.
  • Check Windows Server 2025 Task Scheduler and SQL Server Agent Jobs for overlapping backup schedules targeting the same blob container.

Step 2: Clear Blob Lease Locks in Azure Storage

  • Navigate to the Azure Portal and locate the Storage Account associated with your Backup to URL configuration.
  • Open the specific container and locate the .bak file in question.
  • Under Properties, check the Lease Status field; if it shows “Leased,” manually break the lease using Azure Storage Explorer or the following PowerShell command:
  • Get-AzStorageBlob -Container "yourcontainer" -Blob "yourfile.bak" -Context $ctx | ForEach-Object { $_.ICloudBlob.BreakLease() }

Step 3: Validate Credential and SAS Token Configuration

  • In SSMS, expand Server Objects > Credentials and verify the credential used for the backup matches the current Storage Account key or SAS token.
  • Regenerate the SAS token with sufficient read/write/delete permissions if it has expired.
  • Update the credential using:
  • ALTER CREDENTIAL [https://yourstorageaccount.blob.core.windows.net/yourcontainer] WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = '<new_sas_token>';

Step 4: Restart SQL Server Service to Clear Internal File Handles

  • Open Services.msc on Windows Server 2025 and locate the SQL Server (MSSQLSERVER) service.
  • Restart the service to release any internal file handles SQL Server may still be holding against the URL target.
  • Re-run the backup job immediately after the service comes back online to prevent re-locking by other scheduled tasks.

Alternative or Verification Steps

  • Run the BACKUP DATABASE [YourDB] TO URL = '<blob_url>' WITH COPY_ONLY command manually in SSMS to confirm the exclusive lock issue is resolved without affecting your backup chain.
  • If the error persists, create a new blob container and point the backup destination there as a workaround, then investigate the original container’s lease history in Azure Monitor logs for root cause analysis.