How to fix Error 4629 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 4629 — Permissions on Server-Scoped Catalog Views Can Only Be Granted in Master

Why This Error Happens

This error occurs because SQL Server 2025 restricts GRANT, DENY, or REVOKE statements targeting server-scoped catalog views, system stored procedures, or extended stored procedures to the master database context only. When a user attempts to run these permission statements while connected to a different database (such as a user database or tempdb), SQL Server rejects the operation since the metadata for these server-level objects is only resolvable within master. This is typically caused by scripts, SSMS session defaults, or application connection strings that default to the wrong database context before executing permission-related DDL.

Step-by-Step Resolution Guide

Step 1: Identify the Current Database Context

  • Open a new query window in SQL Server Management Studio (SSMS) or Azure Data Studio.
  • Run the following command to confirm the active database:
  SELECT DB_NAME() AS CurrentDatabase;
  • If the result is not master, this confirms the root cause of Error 4629.

Step 2: Switch Explicitly to the Master Database

  • Before executing any GRANT/DENY/REVOKE statement on system views or procedures, explicitly switch context using:
  USE master;
  GO
  • Re-run your permission statement immediately after this command, for example:
  GRANT SELECT ON sys.dm_exec_sessions TO [YourUserOrRole];

Step 3: Update Scripts and Deployment Pipelines

  • Check any automated deployment scripts, DACPAC packages, or PowerShell/DBATools scripts for missing USE master; statements.
  • For PowerShell-based deployments using Invoke-Sqlcmd, explicitly set the -Database parameter to master:
  Invoke-Sqlcmd -ServerInstance "YourServer" -Database "master" -InputFile "GrantPermissions.sql"
  • Ensure connection strings in applications specify Initial Catalog=master only for the specific maintenance/permission session, not for general application traffic.

Step 4: Verify SSMS Default Database Settings

  • In SSMS, go to Object Explorer > Connect > Properties > Connection Properties tab.
  • Confirm that “Connect to database” is set to <default> or explicitly to master if this connection is dedicated to administrative tasks.
  • Avoid hardcoding a different default database in login properties (Server > Security > Logins > [Login] > Properties > General > Default database) if that login is responsible for managing server-level permissions.

Alternative or Verification Steps

  • To verify the fix, re-run the original GRANT/DENY/REVOKE statement immediately after executing USE master; — it should complete without Error 4629.
  • As an alternative, query sys.server_permissions while connected to master to confirm the permission was successfully applied:
  SELECT * FROM sys.server_permissions WHERE grantee_principal_id = SUSER_ID('YourUserOrRole');