How to fix Error 4604 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 4604 — “There is no such user or group ‘%.*ls’ or you do not have permission.”

Why This Error Happens

This error typically occurs when a SQL Server statement (such as GRANT, ALTER AUTHORIZATION, or ALTER SERVER ROLE) references a Windows user, Windows group, or SQL login that does not exist in the current security context, or whose SID cannot be resolved against Active Directory or the local SAM database. It can also happen due to orphaned logins left over after a migration, a mismatched domain trust, or incorrect case/formatting in the login name (e.g., using DOMAIN\User syntax incorrectly). Additionally, the SQL Server service account may lack sufficient permissions to query Active Directory for group membership resolution.

Step-by-Step Resolution Guide

Step 1: Verify the Login or Group Exists in Active Directory/Windows

  • Open PowerShell as Administrator and run:
  Get-ADUser -Identity "username" -Server "yourdomain.com"

or for groups:

  Get-ADGroup -Identity "groupname"
  • Confirm the account is not disabled, deleted, or renamed in Active Directory.
  • For local Windows accounts, check via Computer Management > Local Users and Groups on Windows Server 2025/Windows 11.

Step 2: Validate the Login Syntax and Domain Resolution

  • Re-run the failing T-SQL command using the fully qualified name format: DOMAIN\username (not just username).
  • In SSMS, execute:
  SELECT * FROM sys.server_principals WHERE name = 'DOMAIN\username';
  • If the login is missing, recreate it:
  CREATE LOGIN [DOMAIN\username] FROM WINDOWS;
  • Check that the Windows Server 2025 domain controller is reachable (nltest /dsgetdc:yourdomain.com) and there are no DNS/trust issues.

Step 3: Check SQL Server Service Account Permissions

  • Open services.msc and confirm the SQL Server service is running under an account with rights to query AD (typically a domain account, not NT SERVICE\MSSQLSERVER in restricted environments).
  • Ensure the service account has the “Read” permission on the Active Directory objects (user/group) being referenced.
  • Restart the SQL Server service after any account changes:
  net stop MSSQLSERVER
  net start MSSQLSERVER

Step 4: Remove and Recreate Orphaned Logins (If Migrated Database)

  • Identify orphaned users:
  EXEC sp_change_users_login 'Report';
  • Drop the orphaned user mapping and remap it:
  DROP USER [orphaned_user];
  CREATE USER [DOMAIN\username] FOR LOGIN [DOMAIN\username];
  • Re-apply any required role memberships or permissions lost during the drop.

Step 5: Re-run the Original Statement

  • Execute the original GRANT, ALTER AUTHORIZATION, or role-assignment statement again.
  • Confirm Error 4604 no longer appears in SSMS or the SQL Server Error Log (C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG).

Alternative or Verification Steps

  • Verify the fix by querying sys.server_principals and sys.database_principals to confirm the login/user now resolves correctly and has an active SID.
  • If AD resolution continues to fail, as an alternative, create a SQL Server authentication login instead of a Windows-integrated one (CREATE LOGIN [username] WITH PASSWORD = '...') to bypass AD dependency entirely.