Troubleshooting Guide: Error 3505 – CHECKPOINT Permission Denied in SQL Server 2025

Why This Error Happens

Error 3505 occurs because the CHECKPOINT statement, when issued with parameters or in certain contexts, requires the executing login to be the database owner (db_owner) or hold sysadmin/CONTROL permissions on the database. By default, standard users and even some db_datawriter or db_datareader role members do not have sufficient rights to force a manual checkpoint. This typically surfaces when an application service account or a junior DBA attempts to run CHECKPOINT manually via a script, maintenance plan, or automated job without the proper role membership.

Step-by-Step Resolution Guide

Step 1: Identify the Executing Login and Database Context

• Open SQL Server Management Studio (SSMS) and connect using an account with sysadmin privileges.
• Run the following query to identify the current login attempting the command:

  SELECT SUSER_NAME(), CURRENT_USER;

• Confirm the target database name referenced in the error message (%.*ls placeholder) to ensure you are modifying permissions on the correct database.

Step 2: Verify Current Role Membership

• Execute the following command to check if the user belongs to the db_owner role:

  USE [YourDatabaseName];
  EXEC sp_helprolemember 'db_owner';

• If the login is missing from this list, proceed to grant the necessary permissions in Step 3.

Step 3: Grant Appropriate Permissions

• To add the user to the db_owner role (recommended for full administrative control), run:

  USE [YourDatabaseName];
  ALTER ROLE db_owner ADD MEMBER [DOMAIN\Username];

• Alternatively, if you want to avoid full db_owner rights, grant the specific CONTROL permission on the database:

  GRANT CONTROL ON DATABASE::[YourDatabaseName] TO [DOMAIN\Username];

• Save the changes and ensure no syntax errors were returned in the Messages pane.

Step 4: Restart the Session or Service

• Ask the user to close and reopen their SSMS connection to refresh their permission token cache.
• If the CHECKPOINT command is being run via an automated SQL Server Agent Job, restart the SQL Server Agent service via services.msc on the Windows Server 2025 host to clear any cached job owner credentials.

Alternative or Verification Steps

• Verification: Have the user re-run the CHECKPOINT; command in a query window connected to the specific database; a successful execution will return “Command(s) completed successfully” with no red error text.
• Alternative: If modifying roles is not permitted by your security policy, rewrite the maintenance script to run under a SQL Server Agent proxy account that already possesses sysadmin rights, bypassing the need to alter the end-user’s permissions.