How to fix Error 372 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 372 – External Access Policy Validation Failure

Why This Error Happens

This error occurs when SQL Server 2025’s external access policy cache has expired or become corrupted, preventing the engine from validating permissions against the configured policy provider. It commonly happens when the local machine loses connectivity to the policy endpoint (Azure Arc, Active Directory, or an on-prem policy server), or when the service account lacks the necessary rights to refresh the cached policy token. Corrupted policy cache files in the SQL Server data directory can also trigger this failure even when connectivity and permissions are intact.

Step-by-Step Resolution Guide

Step 1: Verify Network and Endpoint Connectivity

  • Confirm the SQL Server host can reach the policy provider endpoint (Azure Arc gateway, AD domain controller, or custom policy server).
  • Run Test-NetConnection <policy-endpoint> -Port 443 from PowerShell to confirm outbound access.
  • Check C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG for prior connection timeout entries.

Step 2: Force a Manual Policy Refresh

  • Open an elevated PowerShell session and run:
    Invoke-SqlPolicyRefresh -ServerInstance "localhost" -Force
  • Alternatively, use SQLCMD to trigger the refresh: sqlcmd -S localhost -Q "EXEC sp_refresh_external_policy @force = 1;"
  • Confirm the command returns “Policy fetch successful” rather than a timeout or access-denied message.

Step 3: Clear the Local Policy Cache

  • Stop the SQL Server service via services.msc or Stop-Service MSSQLSERVER.
  • Navigate to C:\ProgramData\Microsoft\SQL Server\ExternalPolicyCache\ and delete all .cache and .token files.
  • Restart the service with Start-Service MSSQLSERVER to allow SQL Server to rebuild the cache from scratch.

Step 4: Validate Service Account Permissions

  • Open sqlservermanager17.msc and confirm the SQL Server service account has “Validate Policy Access” rights under the security policy provider.
  • If using Active Directory-integrated policies, ensure the service account is a member of the SQLPolicyValidators security group.
  • Re-run the SQL Server Configuration Manager permissions checker to confirm no pending permission changes.

Step 5: Restart Dependent Services and Re-test

  • Restart the SQL Server Agent and SQL Server Browser services to ensure they pick up the refreshed policy state.
  • Run a test query or connection attempt from SSMS to confirm Error 372 no longer appears in the session log.

Alternative or Verification Steps

  • Check the Windows Event Viewer under Applications and Services Logs > Microsoft > SQL Server > Admin for a follow-up event confirming successful policy validation (Event ID 373 or similar success code).
  • If the error persists after cache clearing, temporarily disable external policy enforcement via sp_configure 'external policy enforcement', 0; (test environments only) to confirm the issue is isolated to policy validation rather than another underlying permissions problem.