How to fix Error 4602 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 4602 – CREATE DATABASE Permission Restricted to Sysadmin Role

Why This Error Happens

Error 4602 occurs because the CREATE DATABASE permission in SQL Server 2025 is treated as a securable that, by design, can only be granted or revoked by a member of the fixed sysadmin server role. This restriction is a security hardening measure to prevent privilege escalation, meaning that login accounts belonging to lower-privileged roles (such as dbcreator or custom server roles) will be denied when attempting to execute GRANT or REVOKE statements on this permission. The underlying cause is almost always an insufficient role assignment on the executing login, not a corrupted file or port conflict.

Step-by-Step Resolution Guide

Step 1: Verify the Current Login’s Role Membership

  • Open SQL Server Management Studio (SSMS) on your Windows Server 2025 or Windows 11 machine and connect to the target instance.
  • Run the following query to check role membership:
  • SELECT roles.name AS RoleName, members.name AS LoginName FROM sys.server_role_members rm JOIN sys.server_principals roles ON rm.role_principal_id = roles.principal_id JOIN sys.server_principals members ON rm.member_principal_id = members.principal_id;
  • Confirm whether the login attempting the GRANT/REVOKE action is listed under the “sysadmin” role.

Step 2: Elevate the Login to Sysadmin (If Authorized)

  • If organizational policy permits, add the login to the sysadmin role using:
  • ALTER SERVER ROLE sysadmin ADD MEMBER [YourDomain\YourLogin];
  • Ensure you run this command while logged in as an existing sysadmin (e.g., the default “sa” account or a Windows account with sysadmin rights).
  • Restart the SQL Server service via Services.msc or net stop MSSQLSERVER && net start MSSQLSERVER if the change does not take effect immediately.

Step 3: Use a Sysadmin Account to Perform the GRANT/REVOKE

  • Instead of elevating a standard user, log in directly with an account that already has sysadmin rights.
  • Execute the permission change on behalf of the lower-privileged login:
  • GRANT CREATE DATABASE TO [YourDomain\YourLogin];
  • This avoids unnecessarily expanding sysadmin membership while still resolving the immediate permission need.

Step 4: Check for Group Policy or Azure AD Conflicts

  • On Windows Server 2025, verify that Group Policy Objects (GPOs) are not overriding local SQL Server authentication settings.
  • Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment and confirm the SQL Server service account has “Log on as a service” rights.
  • If using Azure AD-integrated authentication, confirm the login is correctly synced and mapped to the appropriate SQL Server role via sys.server_principals.

Alternative or Verification Steps

  • After applying the fix, test by logging in as the affected user and running CREATE DATABASE TestDB; — if it succeeds without Error 4602, the permission change was applied correctly.
  • As an alternative, use the dedicated dbcreator fixed server role instead of modifying sysadmin membership: ALTER SERVER ROLE dbcreator ADD MEMBER [YourDomain\YourLogin]; — this grants database creation rights without full administrative control.