How to fix Error 5011 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 5011 – “User Does Not Have Permission to Alter Database”

Why This Error Happens

This error occurs when the login attempting to execute an ALTER DATABASE statement lacks the required ALTER ANY DATABASE server-level permission or is not a member of the dbcreator/sysadmin fixed server roles. It can also happen if the database owner (DB Owner) mapping is broken—often seen after a database migration or restore where the Windows SID or SQL login SID no longer matches the owner recorded in sys.databases. Additionally, on Windows Server 2025 and Windows 11 hosts, strict User Account Control (UAC) and Credential Guard policies can silently downgrade an Administrator’s token, preventing inherited sysadmin rights from applying correctly within SQL Server 2025.

Step-by-Step Resolution Guide

Step 1: Verify the Current Login’s Server Role Membership

  • Open SQL Server Management Studio (SSMS) and connect using an account known to have sysadmin rights (or connect locally via sqlcmd -S localhost -E).
  • Run the following query to check role membership for the affected login:
  SELECT sp.name AS LoginName, sr.name AS RoleName
  FROM sys.server_role_members srm
  JOIN sys.server_principals sp ON srm.member_principal_id = sp.principal_id
  JOIN sys.server_principals sr ON srm.role_principal_id = sr.principal_id
  WHERE sp.name = 'YOUR_LOGIN_HERE';
  • If the login is missing from sysadmin or dbcreator, proceed to Step 2.

Step 2: Grant the Required Server-Level Permission

  • Rather than granting full sysadmin, apply the least-privilege fix by granting ALTER ANY DATABASE directly:
  USE master;
  GRANT ALTER ANY DATABASE TO [DOMAIN\YourUser];
  • If the user needs to manage only a specific database, instead add them as db_owner on that database:
  USE YourDatabaseName;
  ALTER ROLE db_owner ADD MEMBER [DOMAIN\YourUser];

Step 3: Repair Orphaned Database Ownership

  • Check if the database owner SID is invalid or orphaned, which commonly triggers Error 5011 after a restore:
  SELECT name, suser_sname(owner_sid) AS OwnerName
  FROM sys.databases
  WHERE name = 'YourDatabaseName';
  • If OwnerName returns NULL, reassign ownership to a valid sysadmin login:
  ALTER AUTHORIZATION ON DATABASE::YourDatabaseName TO sa;

Step 4: Check Windows-Level UAC and Token Elevation

  • On Windows Server 2025 / Windows 11, open secpol.msc and navigate to Local Policies > Security Options.
  • Confirm “User Account Control: Run all administrators in Admin Approval Mode” is not blocking token elevation for the SQL Server service account.
  • Restart the SQL Server service (services.msc → SQL Server (MSSQLSERVER) → Restart) after any policy change to force token refresh.

Step 5: Restart SQL Server Service and Re-Test

  • Open PowerShell as Administrator and restart the instance:
  Restart-Service -Name 'MSSQLSERVER' -Force
  • Reconnect via SSMS and re-run the original ALTER DATABASE command to confirm the permission error is cleared.

Alternative or Verification Steps

  • Verify the fix by running SELECT IS_SRVROLEMEMBER('sysadmin') or EXECUTE AS LOGIN = 'DOMAIN\YourUser'; SELECT USER_NAME(); to confirm correct role assumption before retrying the ALTER DATABASE statement.
  • If permissions still fail, use the Dedicated Admin Connection (DAC) via sqlcmd -S admin:localhost -E to bypass normal authentication checks and directly correct role memberships at the server level.