How to fix Error 5349 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 5349 — ERRORFILE_SECRET Cannot Be Specified Without ERRORFILE Option

Why This Error Happens

This error occurs when a BACKUP or RESTORE statement in SQL Server 2025 includes the ERRORFILE_SECRET option without also specifying the required ERRORFILE parameter. The ERRORFILE_SECRET option is designed to supply a decryption key or token specifically tied to an error log file defined by ERRORFILE, so SQL Server’s parser rejects the command because it cannot validate an orphaned secret with no target file. This is typically caused by a manually written or auto-generated T-SQL script that was edited incorrectly, or a migration/automation tool that failed to pass both parameters together.

Step-by-Step Resolution Guide

Step 1: Locate the Offending T-SQL Script

  • Identify the specific BACKUP DATABASE or RESTORE DATABASE statement that triggered Error 5349 in SQL Server Management Studio (SSMS) or your deployment pipeline logs.
  • Check Windows Event Viewer under Applications and Services Logs > MSSQLSERVER for the exact timestamp and query context tied to Event ID 5349.

Step 2: Add the Missing ERRORFILE Parameter

  • Open the script in SSMS or your preferred editor and locate the WITH clause of the backup/restore command.
  • Add the ERRORFILE option pointing to a valid, writable path, for example:
  BACKUP DATABASE [YourDB]
  TO DISK = 'C:\SQLBackups\YourDB.bak'
  WITH ERRORFILE = 'C:\SQLBackups\Logs\YourDB_error.log',
       ERRORFILE_SECRET = 'YourSecretValue';
  • Ensure the folder (e.g., C:\SQLBackups\Logs\) exists on the Windows Server 2025 host and is accessible to the SQL Server service account.

Step 3: Verify File System Permissions

  • Confirm the SQL Server service account (visible in SQL Server Configuration Manager) has Write and Modify permissions on the ERRORFILE directory.
  • Use icacls "C:\SQLBackups\Logs" in an elevated PowerShell or Command Prompt window to audit and, if needed, grant permissions:
  icacls "C:\SQLBackups\Logs" /grant "NT SERVICE\MSSQLSERVER:(OI)(CI)M"

Step 4: Re-run the Script and Monitor Execution

  • Execute the corrected script in SSMS or via sqlcmd.
  • Watch the Messages tab or command-line output for successful completion without Error 5349 reappearing.

Alternative or Verification Steps

  • Run SELECT * FROM msdb.dbo.backupset ORDER BY backup_start_date DESC; to confirm the backup job completed and logged correctly.
  • If the error persists, remove ERRORFILE_SECRET entirely (if encryption isn’t strictly required) and re-test with only ERRORFILE specified to isolate whether the secret value itself is malformed.