How to fix Error 6265 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 6265 — PInvoke Not Allowed in Assembly

Why This Error Happens

This error occurs because SQL Server enforces strict Code Access Security (CAS) permission levels for CLR integration (SAFE, EXTERNALACCESS, and UNSAFE). A SAFE or EXTERNALACCESS assembly is attempting to register a type that contains a pinvokeimpl method, which calls unmanaged code outside the .NET runtime boundary. Since P/Invoke calls can directly access the operating system and memory outside the CLR’s managed sandbox, SQL Server blocks this registration unless the assembly is explicitly marked as UNSAFE.

Step-by-Step Resolution Guide

Step 1: Identify the Offending Assembly and Method

  • Review the full error message to extract the assembly name and type referenced in the %.*ls placeholders.
  • Open the source project in Visual Studio and search for [DllImport(...)] attributes, as these indicate P/Invoke usage.
  • Confirm whether the P/Invoke call is actually required for the assembly’s functionality or if it can be refactored out.

Step 2: Change the Assembly Permission Set to UNSAFE

  • Connect to the instance using SQL Server Management Studio (SSMS) 21 or later.
  • Run the following T-SQL command to alter the existing assembly’s permission set:
ALTER ASSEMBLY YourAssemblyName
WITH PERMISSION_SET = UNSAFE;
  • If creating the assembly for the first time, use:
CREATE ASSEMBLY YourAssemblyName
FROM 'C:\SQLAssemblies\YourAssembly.dll'
WITH PERMISSION_SET = UNSAFE;

Step 3: Enable TRUSTWORTHY or Sign the Assembly

  • Since Windows Server 2025 and SQL Server 2025 enforce stricter security defaults, UNSAFE assemblies require the database to be marked as trustworthy, or the assembly must be signed with a certificate.
  • To use the trustworthy method (simpler but less secure), run:
ALTER DATABASE YourDatabaseName SET TRUSTWORTHY ON;
  • For a production-safe approach, sign the assembly with an asymmetric key or certificate and create a corresponding login with UNSAFE ASSEMBLY permission:
CREATE ASYMMETRIC KEY YourAssemblyKey
FROM EXECUTABLE FILE = 'C:\SQLAssemblies\YourAssembly.dll';

CREATE LOGIN YourAssemblyLogin
FROM ASYMMETRIC KEY YourAssemblyKey;

GRANT UNSAFE ASSEMBLY TO YourAssemblyLogin;

Step 4: Verify CLR Integration is Enabled

  • Confirm that CLR integration is turned on at the instance level, as this is a prerequisite for any assembly registration.
  • Run the following to check and enable it if needed:
sp_configure 'clr enabled', 1;
RECONFIGURE;
  • Restart the SQL Server service via SQL Server Configuration Manager if you just enabled this setting.

Alternative or Verification Steps

  • To verify the fix, re-run the original CREATE ASSEMBLY or ALTER ASSEMBLY statement; it should complete without raising Error 6265, and you can confirm the permission set by querying SELECT name, permission_set_desc FROM sys.assemblies;.
  • If altering to UNSAFE is not acceptable for your security policy, consider rewriting the managed code to eliminate the P/Invoke call entirely (e.g., replacing unmanaged OS calls with native .NET/SQLCLR-safe libraries) so the assembly can remain SAFE or EXTERNAL_ACCESS.