How to fix Error 4613 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 4613 occurs when a principal (grantor) attempts to delegate a permission they do not themselves hold with GRANT OPTION. This typically happens when a role or login was granted a permission directly (without the WITH GRANT OPTION clause) but is still being used to cascade that same permission to another user or role. It can also surface after a database migration or restore where permission metadata becomes inconsistent with the current security hierarchy.

Step-by-Step Resolution Guide

Step 1: Identify the Grantor and Missing Permission

  • Open SQL Server Management Studio (SSMS) and connect to the SQL Server 2025 instance.
  • Run the following query to inspect current permission states:
SELECT * FROM sys.database_permissions 
WHERE grantee_principal_id = USER_ID('TargetUser');
  • Confirm whether the state_desc column shows GRANT instead of GRANT_WITH_GRANT_OPTION for the grantor.

Step 2: Re-Grant Permission With the GRANT OPTION Flag

  • As a sysadmin or db_owner, execute the corrected permission statement:
GRANT SELECT ON dbo.YourTable TO GrantorUser WITH GRANT OPTION;
  • Replace SELECT and dbo.YourTable with the actual permission and object causing the conflict.
  • Ensure this is run in the correct database context using USE [YourDatabaseName]; beforehand.

Step 3: Validate Role Membership and Ownership Chains

  • Check if the grantor belongs to a Windows Server 2025 Active Directory group that may have conflicting or duplicate permission assignments.
  • Open Server Manager > Tools > Active Directory Users and Computers to confirm group membership is current and not stale.
  • Remove any redundant DENY permissions that may override the GRANT using:
REVOKE SELECT ON dbo.YourTable FROM GrantorUser CASCADE;

Step 4: Restart the SQL Server Service to Clear Cached Permissions

  • Open Services.msc on Windows Server 2025 / Windows 11.
  • Locate SQL Server (MSSQLSERVER) or your named instance.
  • Right-click and select Restart to flush the permission cache and security token cache.

Alternative or Verification Steps

  • Re-run the original GRANT command as the target user to confirm the error 4613 no longer appears in the SQL Server Error Log (Event Viewer > Applications and Services Logs > MSSQLSERVER).
  • If the issue persists, drop and recreate the user/role mapping via sp_droprolemember and sp_addrolemember to rebuild the permission chain from a clean state.