How to fix Error 4624 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 4624 – “Cannot Grant Data” in Microsoft SQL Server 2025

Why This Error Happens

Error 4624 typically occurs when the SQL Server service account lacks the necessary database-level or object-level permissions to complete a GRANT statement, often due to an incomplete security principal mapping between Windows Server 2025 authentication and SQL Server’s internal permission tables. This can also result from orphaned users where the Windows SID does not correctly map to the SQL Server login, commonly triggered after a migration or restore from an older instance. In some cases, a corrupted or inconsistent system catalog (sys.database_permissions) prevents the GRANT operation from being written correctly.

Step-by-Step Resolution Guide

Step 1: Verify the Service Account and Login Mapping

  • Open SQL Server Configuration Manager and confirm the SQL Server (MSSQLSERVER) service is running under a valid domain or local service account.
  • Run the following query to check for orphaned users: EXEC sp_change_users_login 'Report';
  • If orphaned users are found, remap them using: ALTER USER [username] WITH LOGIN = [loginname];

Step 2: Re-establish Correct Permissions Manually

  • Open SQL Server Management Studio (SSMS) as an Administrator on Windows Server 2025 or Windows 11.
  • Execute USE [YourDatabaseName]; GO followed by GRANT SELECT, INSERT, UPDATE ON [SchemaName].[TableName] TO [UserName];
  • If the error persists, check for a deny permission conflict using: SELECT * FROM sys.database_permissions WHERE grantee_principal_id = USER_ID('UserName');

Step 3: Repair System Catalog Inconsistencies

  • Run DBCC CHECKDB ('YourDatabaseName') WITH NO_INFOMSGS, ALL_ERRORMSGS; to rule out catalog corruption.
  • If corruption is detected, restore the database from the last known good backup rather than using repairallowdata_loss.
  • Restart the SQL Server service via services.msc or PowerShell: Restart-Service MSSQLSERVER.

Step 4: Validate Windows Security Policies

  • Navigate to Local Security Policy > Local Policies > User Rights Assignment on the Windows Server 2025 host.
  • Ensure “Log on as a service” includes the SQL Server service account.
  • Confirm Group Policy objects are not overriding local SQL Server permission inheritance via gpresult /h report.html.

Alternative or Verification Steps

  • Verify the fix by logging in as the affected user and running a test SELECT or INSERT query against the target table to confirm the GRANT took effect.
  • As an alternative, if permissions still fail to apply, drop the user from the database entirely using DROP USER [UserName]; and recreate them fresh with CREATE USER [UserName] FOR LOGIN [LoginName]; before reapplying the grants.