How to fix Error 3813 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 3813 occurs during a SQL Server login upgrade (typically during migration, restore, or version upgrade to SQL Server 2025) when the Security Identifier (SID) or login name being migrated already exists in the sys.server_principals table on the destination instance. This is common when a Windows login or SQL login was previously created manually on the target server, or when the same domain account maps to a cached SID left over from a prior uninstall. The SQL Server Database Engine enforces unique SID and name constraints at the server level, so it rejects the upgrade to prevent principal collisions that would break ownership chains and permission mappings.

Step-by-Step Resolution Guide

Step 1: Identify the Conflicting Login or Role

  • Open SQL Server Management Studio (SSMS) and connect to the target instance.
  • Run the following query to locate duplicate names or SIDs:
SELECT name, sid, type_desc 
FROM sys.server_principals 
WHERE name = 'ConflictingLoginName' OR sid = 0x...;
  • Note whether the conflict is with a login or a server role, as this changes the remediation path.

Step 2: Resolve the Name or SID Collision

  • If the existing login is obsolete or unused, drop it first:
DROP LOGIN [ConflictingLoginName];
  • If the login is a renamed duplicate (same SID, different name), rename the existing object instead of dropping it:
ALTER LOGIN [OldName] WITH NAME = [NewUniqueName];
  • For orphaned Windows logins with stale SIDs (common after domain rejoin on Windows Server 2025), remove the orphaned entry using sp_dropserver or DROP LOGIN, then re-run the upgrade/import process.

Step 3: Re-run the Login Migration or Upgrade Script

  • If using sp_help_revlogin or the Database Migration Assistant, re-execute the generated script after cleanup.
  • If this occurred during an in-place upgrade to SQL Server 2025, restart the Setup.exe /Action=Upgrade process after confirming no duplicate SIDs remain.
  • Check the SQL Server Error Log (C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG) for confirmation that the login was created successfully.

Step 4: Validate Server Role Membership

  • If the conflict involved a custom server role rather than a login, verify role membership mapping:
SELECT * FROM sys.server_role_members;
  • Reassign any broken role memberships using ALTER SERVER ROLE [RoleName] ADD MEMBER [LoginName];

Alternative or Verification Steps

  • Confirm the fix by querying sys.server_principals again to ensure only one entry exists per name/SID pair, then attempt a test login via SSMS or sqlcmd -S servername -U username.
  • If the error persists after cleanup, use sp_change_users_login 'Report' at the database level to detect any lingering orphaned user mappings tied to the old SID, then re-link them with ALTER USER [UserName] WITH LOGIN = [CorrectLoginName].