How to fix Error 4625 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 4625 — “There is no such server principal %.*s or you do not have permission”

Why This Error Happens

This error occurs when a login attempts to execute a statement (such as ALTER SERVER ROLE, GRANT, or impersonation commands) that references a server principal (login) which either does not exist in the sys.server_principals catalog or exists but the calling account lacks sufficient permission to view or reference it. This is common after a database migration, a login being dropped or renamed, or when a Windows/Active Directory account referenced in a SQL login no longer resolves correctly due to SID mismatches. It can also surface in mixed-mode environments where contained database users or orphaned SIDs break the mapping between Windows Server 2025 security principals and SQL Server 2025 internal metadata.

Step-by-Step Resolution Guide

Step 1: Verify the Server Principal Exists

  • Open SQL Server Management Studio (SSMS) and connect with an account that has sysadmin or securityadmin role.
  • Run the following query to confirm the login is present:
  SELECT name, sid, type_desc FROM sys.server_principals WHERE name = 'DOMAIN\UserOrLoginName';
  • If no rows return, the login was deleted, renamed, or never created — proceed to Step 2.

Step 2: Recreate or Re-Map the Missing Login

  • If the login is a SQL login, recreate it using:
  CREATE LOGIN [LoginName] WITH PASSWORD = 'StrongPassword123!';
  • If it’s a Windows account, ensure it still exists in Active Directory or the local Windows Server 2025 Computer Management > Local Users and Groups console, then re-add it:
  CREATE LOGIN [DOMAIN\UserName] FROM WINDOWS;
  • For orphaned SIDs after a restore/migration, run sp_help_revlogin or use ALTER USER to remap the user to the correct login SID.

Step 3: Check and Grant Required Permissions

  • Ensure the executing account has VIEW SERVER STATE or ALTER ANY LOGIN permission if it needs to query or modify other principals:
  GRANT VIEW SERVER STATE TO [LoginName];
  GRANT ALTER ANY LOGIN TO [LoginName];
  • Confirm the account isn’t a member of a role that has been explicitly denied access using sys.server_permissions.

Step 4: Validate SQL Server Service Account Context

  • In Windows Server 2025, open Services.msc and confirm the SQL Server (MSSQLSERVER) service account has not changed since the login mappings were created.
  • If the service account was reset via Group Policy or domain re-join, restart the SQL Server service and re-run authentication tests.

Step 5: Restart SQL Server and Re-Test Authentication

  • Restart the SQL Server instance via SSMS or net stop MSSQLSERVER && net start MSSQLSERVER in an elevated Command Prompt.
  • Attempt the original operation that triggered Error 4625 again to confirm resolution.

Alternative or Verification Steps

  • Run SELECT * FROM sys.login_token; under the affected login’s session to confirm it now resolves correctly with valid server-level permissions.
  • If the issue persists, use sp_validatelogins to detect orphaned Windows logins and clean up stale SID mappings between Windows Server 2025 Active Directory and SQL Server 2025 metadata.