How to fix Error 5536 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 5536 — FILESTREAM Deleted Folder Corruption

Why This Error Happens

This error occurs when SQL Server’s FILESTREAM garbage collection process attempts to reconcile the internal “tombstone” table of deleted FILESTREAM directories against the actual NTFS filesystem state, and finds a mismatch or corruption in the folder structure. This is typically caused by an unexpected shutdown, antivirus/backup software interfering with FILESTREAM data containers while SQL Server had file handles open, or manual tampering with files inside the FILESTREAM data container outside of SQL Server’s control. On Windows Server 2025 and Windows 11, this is also frequently triggered by Windows Defender’s enhanced real-time protection scanning and locking files inside the FILESTREAM container during the deletion/garbage-collection cycle.

Step-by-Step Resolution Guide

Step 1: Take the Database Offline and Isolate the FILESTREAM Container

  • Stop the SQL Server service or take the affected database OFFLINE via SSMS to prevent further garbage collection attempts from writing to the corrupted folder.
  • Locate the FILESTREAM data container path (check sys.database_files or the database properties FILESTREAM filegroup path, typically under D:\SQLData\FILESTREAM\).
  • Navigate to the $FSLOG folder and the numeric GUID-named subfolder referenced in the error message to confirm the folder is missing, empty, or has broken ACLs.

Step 2: Exclude FILESTREAM Paths from Antivirus and Windows Defender

  • Open Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions.
  • Add the full FILESTREAM container path (e.g., D:\SQLData\FILESTREAM\) and the $FSLOG subfolder as folder exclusions.
  • Run Set-MpPreference -ExclusionPath "D:\SQLData\FILESTREAM\" in an elevated PowerShell session on Windows Server 2025 to enforce this via policy.
  • Restart the SQL Server service to clear any stale file locks.

Step 3: Repair Permissions and NTFS Integrity on the Container

  • Verify the SQL Server service account has Full Control NTFS permissions on the FILESTREAM root folder and all subfolders (right-click folder > Properties > Security tab).
  • Run chkdsk D: /f /r (adjust drive letter) during a maintenance window to repair underlying NTFS corruption that may be causing orphaned or inaccessible folder entries.
  • Re-apply permissions recursively using icacls "D:\SQLData\FILESTREAM" /reset /T followed by granting the SQL Server service account access.

Step 4: Restore from Backup if Corruption Persists

  • If the folder structure cannot be repaired, restore the database from the last known good full backup plus transaction log backups using RESTORE DATABASE [YourDB] FROM DISK = 'backup.bak' WITH NORECOVERY, followed by log restores.
  • Ensure FILESTREAM filegroups are included in the backup set (WITH FILESTREAM was not excluded during backup) before attempting the restore.
  • Bring the database online with RESTORE DATABASE [YourDB] WITH RECOVERY once all logs are applied.

Alternative or Verification Steps

  • After applying fixes, run DBCC CHECKDB('YourDB') WITH ALL_ERRORMSGS and check the SQL Server error log for Event ID 5536 recurrence to confirm resolution.
  • If the issue persists, run DBCC CHECKFILEGROUP against the FILESTREAM filegroup specifically, and consider detaching/reattaching the database after manually rebuilding the $FSLOG folder structure with SQL Server service stopped.