How to fix Error 4885 on Windows Server 2025 / Windows 11

by

Microsoft SQL Server 2025 — Error 4885 Troubleshooting Guide

Why This Error Happens

This error occurs when SQL Server attempts to open a backup or data file using SQL authentication credentials while the underlying file (often on a mapped network drive, UNC path, or encrypted volume) is only accessible via Windows Integrated Authentication. It typically surfaces during RESTORE or BACKUP operations where the SQL Server service account lacks NTFS permissions on the target path, or the connection was established using a SQL login rather than a Windows account. Additionally, this can happen if the file resides on a share that explicitly disallows NTLM/SQL-based access and enforces Kerberos-only authentication.

Step-by-Step Resolution Guide

Step 1: Verify the Authentication Mode of Your Connection

  • Confirm whether the current session is using SQL Server Authentication instead of Windows Authentication.
  • In SSMS, reconnect using Windows Authentication (Object Explorer → Connect → Database Engine → Authentication: Windows Authentication).
  • If using sqlcmd, reconnect with the -E flag instead of -U/-P:
  sqlcmd -S ServerName -E

Step 2: Check NTFS and Share Permissions on the Target File/Folder

  • Navigate to the file path referenced in the error (e.g., D:\Backups\ or \\FileServer\SQLBackups\).
  • Right-click the folder → Properties → Security tab.
  • Ensure the SQL Server service account (e.g., NT Service\MSSQLSERVER or your custom domain service account) has Read/Write permissions.
  • If using a UNC path, verify the Share Permissions tab also grants the service account access, not just NTFS permissions.

Step 3: Validate Kerberos/SPN Configuration (for Network Shares)

  • Run the following to check registered SPNs for the SQL Server service account:
  setspn -L DOMAIN\SQLServiceAccount
  • If SPNs are missing or misconfigured, register them:
  setspn -S MSSQLSvc/SQLServerHostName:1433 DOMAIN\SQLServiceAccount
  • Restart the SQL Server service after updating SPNs: Restart-Service MSSQLSERVER.

Step 4: Switch SQL Server Service Account (If Using Local System/Network Service)

  • Open SQL Server Configuration Manager → SQL Server Services.
  • Right-click the SQL Server instance → Properties → Log On tab.
  • Change the account from Local System/Network Service to a domain service account with proper file/share access.
  • Apply changes and restart the service.

Step 5: Re-run the Backup/Restore Operation

  • Attempt the original BACKUP DATABASE or RESTORE DATABASE command again using Windows Authentication.
  • Confirm the file path is accessible and the operation completes without Error 4885.

Alternative or Verification Steps

  • Verify the fix: Run RESTORE FILELISTONLY FROM DISK = 'FilePath' using a Windows-authenticated session to confirm the file opens without error.
  • Alternative workaround: If domain/Kerberos issues persist, move the backup file to a local disk on the SQL Server host (avoiding UNC paths entirely) and retry the operation using local NTFS permissions only.