How to fix Error 4618 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 4618 – “You do not have permission to use %.*ls in the AS clause”

Why This Error Happens

This error occurs when a user attempts to create or alter a view, stored procedure, or function using an EXECUTE AS clause that references a principal (user or login) they do not have IMPERSONATE permission on. SQL Server 2025 enforces strict validation of impersonation rights at the time the object is created, not just at execution. This is commonly seen after database migrations, permission audits, or when a login referenced in the AS clause has been dropped, renamed, or had its permissions revoked.

Step-by-Step Resolution Guide

Step 1: Identify the Principal Causing the Failure

  • Open the exact error message in SQL Server Management Studio (SSMS) and note the user/login name inserted into the %.*ls placeholder.
  • Run the following query to confirm the principal exists in the target database:
SELECT name, type_desc FROM sys.database_principals WHERE name = 'TargetUserName';
  • If the principal does not exist, you will need to either create it or update the EXECUTE AS clause to reference a valid user.

Step 2: Grant IMPERSONATE Permission to the Calling User

  • Connect to the database using an account with ALTER ANY USER or sysadmin rights.
  • Execute the following T-SQL command, replacing placeholders with your actual values:
USE [YourDatabaseName];
GRANT IMPERSONATE ON USER::[TargetUserName] TO [CallingUserName];
  • If the AS clause references a login rather than a database user, grant permission at the server level instead:
GRANT IMPERSONATE ON LOGIN::[TargetLoginName] TO [CallingLoginName];

Step 3: Verify Ownership Chaining and Database Trustworthy Settings

  • Check if the database has cross-database ownership chaining disabled, which can interfere with EXECUTE AS validation.
  • Run this query to inspect the current setting:
SELECT name, is_trustworthy_on FROM sys.databases WHERE name = 'YourDatabaseName';
  • If cross-database calls are required, enable the trustworthy property (only if your security policy allows it):
ALTER DATABASE [YourDatabaseName] SET TRUSTWORTHY ON;

Step 4: Re-Deploy the Object with Corrected Permissions

  • Re-run the CREATE PROCEDURE, CREATE VIEW, or CREATE FUNCTION script that originally failed.
  • Confirm the EXECUTE AS clause syntax matches one of the valid options: CALLER, SELF, OWNER, or a specific 'UserName'.
  • Example corrected syntax:
CREATE PROCEDURE dbo.MyProcedure
WITH EXECUTE AS 'TargetUserName'
AS
BEGIN
    SELECT 1;
END

Step 5: Restart the SQL Server Service to Clear Cached Permission Tokens

  • Open Services.msc on Windows Server 2025 / Windows 11.
  • Locate SQL Server (MSSQLSERVER) or your named instance, right-click, and select Restart.
  • This clears any stale security token caches that may still be blocking the impersonation check.

Alternative or Verification Steps

  • Verify the fix by executing the previously failed script again and confirming the object compiles without Error 4618; then test execution under the calling user’s context using EXECUTE AS USER = 'CallingUserName'; EXEC dbo.MyProcedure; REVERT;.
  • If permissions still fail, use EXECUTE AS CALLER as a temporary workaround to bypass impersonation requirements while you audit the full permission chain with sp_helprotect or Extended Events tracing.