Troubleshooting Guide: SQL Server Error 4621

Why This Error Happens

This error occurs when a GRANT, DENY, or REVOKE statement targeting a server-scoped permission (such as CREATE ANY DATABASE, ALTER ANY LOGIN, or VIEW SERVER STATE) is executed while the active database context is set to something other than master. SQL Server 2025 enforces this restriction because server-level permissions are stored and validated against system catalogs that only exist in the master database. This is most commonly seen when scripts or automated deployment tools run permission statements without explicitly setting the database context first, or when a user’s default database differs from master.

Step-by-Step Resolution Guide

Step 1: Verify the Current Database Context

• Open SQL Server Management Studio (SSMS) or Azure Data Studio and run SELECT DB_NAME(); to confirm which database is currently active.
• Check the database dropdown in the SSMS toolbar — it should display master, not msdb, tempdb, or a user database.
• If connecting via sqlcmd, verify the connection string does not specify a different default database.

Step 2: Explicitly Switch to the Master Database

• Add a USE master; statement immediately before the permission statement in your script:

  USE master;
  GO
  GRANT VIEW SERVER STATE TO [DOMAIN\User];
  GO

• If using a deployment tool (e.g., DACPAC, Flyway, or Liquibase), ensure the migration script includes the USE master; directive at the top of the relevant block.

Step 3: Check and Correct the Login’s Default Database

• Run the following to confirm the default database assigned to the login:

  SELECT name, default_database_name FROM sys.server_principals WHERE name = 'DOMAIN\User';

• If the default database is incorrect, update it:

  ALTER LOGIN [DOMAIN\User] WITH DEFAULT_DATABASE = master;

• This prevents future connections from landing in the wrong context when no database is explicitly specified.

Step 4: Re-run the Permission Statement

• Close and reopen the query window (or reconnect) to ensure the session picks up the corrected context.
• Execute the original GRANT/DENY/REVOKE statement again, confirming no error is returned.

Alternative or Verification Steps

• Confirm success by querying sys.server_permissions joined with sys.server_principals to verify the permission was applied to the correct login or role.
• If the error persists in an automated pipeline, audit the connection string or ODBC/DSN configuration on Windows Server 2025 to ensure it doesn’t override the database context mid-script.