How to fix Error 3437 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3437 – MS DTC Recovery Failure in SQL Server 2025

Why This Error Happens

This error occurs when SQL Server attempts to recover a database containing in-doubt distributed transactions but cannot communicate with the Microsoft Distributed Transaction Coordinator (MS DTC) service to verify their completion status. The root cause is typically that the MS DTC service is stopped, disabled, or not properly configured to allow network/local communication, or the required firewall ports are blocked. This can also happen after a server migration or restore where the DTC security configuration does not match the original settings, or where local and distributed transaction permissions were not granted to the SQL Server service account.

Step-by-Step Resolution Guide

Step 1: Verify and Start the MS DTC Service

  • Open Services.msc on Windows Server 2025 / Windows 11.
  • Locate Distributed Transaction Coordinator and ensure the Startup Type is set to Automatic.
  • If stopped, right-click and select Start.
  • Alternatively, run this in an elevated PowerShell prompt:
  Set-Service -Name MSDTC -StartupType Automatic
  Start-Service -Name MSDTC

Step 2: Configure MS DTC Security Settings

  • Open Component Services (dcomcnfg.exe).
  • Navigate to Component Services > Computers > My Computer > Distributed Transaction Coordinator > Local DTC.
  • Right-click Local DTC, select Properties, then go to the Security tab.
  • Enable the following checkboxes:
  • Network DTC Access
  • Allow Inbound / Allow Outbound
  • Enable XA Transactions (if applicable)
  • Mutual Authentication Required (or No Authentication Required for test/lab environments)
  • Click OK and allow the DTC service to restart automatically.

Step 3: Check Firewall and Port Configuration

  • Confirm Windows Firewall allows DTC traffic by enabling the predefined rule:
  Enable-NetFirewallRule -DisplayGroup "Distributed Transaction Coordinator"
  • Verify RPC port range (default dynamic range 135, plus ephemeral ports) is not blocked between nodes if running in a clustered or multi-server environment.
  • If using a static DTC port, confirm it matches on both the SQL Server host and any linked server/MSDTC resource manager.

Step 4: Validate SQL Server Service Account Permissions

  • Ensure the SQL Server service account has Act as part of the operating system and Impersonate a client after authentication rights via Local Security Policy > User Rights Assignment.
  • Confirm the account has sufficient permissions on the %SystemRoot%\System32\MSDtc registry and folder structure.
  • Restart the SQL Server service after applying changes:
  Restart-Service -Name MSSQLSERVER

Step 5: Rebuild DTC Log (If Corruption Suspected)

  • Stop the MSDTC service.
  • Delete or rename the existing DTC log file located at C:\Windows\System32\MSDtc\MSDTC.LOG.
  • Restart the MSDTC service to regenerate a fresh log file.
  • Attempt the database recovery operation again.

Alternative or Verification Steps

  • Run sp_helpdistributedtrxlist in SQL Server Management Studio to confirm no orphaned in-doubt transactions remain after applying the fix.
  • If the error persists, use DTCPing.exe or DTCTester.exe between the SQL Server node and any remote resource managers to confirm DTC connectivity is fully restored.