How to fix Error 6586 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 6586 – Assembly Installation Blocked by Existing Policy

Why This Error Happens

This error occurs when SQL Server’s CLR (Common Language Runtime) integration attempts to register or update an assembly, but a conflicting security policy or permission set already exists for that assembly’s strong name or source. This typically happens after a failed or partial assembly deployment, a mismatch between the assembly’s PERMISSION_SET (SAFE, EXTERNAL_ACCESS, UNSAFE) and the current TRUSTWORTHY database setting, or residual metadata from a previous installation that wasn’t cleaned up properly. In SQL Server 2025, stricter CLR strong-name validation and policy enforcement can also trigger this if the assembly catalog views reference an orphaned or duplicate entry.

Step-by-Step Resolution Guide

Step 1: Verify Current Assembly and Policy State

  • Open SQL Server Management Studio (SSMS) and connect to the target instance.
  • Run the following query to inspect existing assemblies:
SELECT * FROM sys.assemblies;
SELECT * FROM sys.trusted_assemblies;
  • Check for duplicate or orphaned entries matching the assembly name in the error message.

Step 2: Drop Conflicting Assembly and Associated Objects

  • Identify dependent objects (stored procedures, triggers, functions) tied to the assembly:
SELECT * FROM sys.assembly_modules WHERE assembly_id = (SELECT assembly_id FROM sys.assemblies WHERE name = 'YourAssemblyName');
  • Drop the assembly cleanly, including WITH NO CHECK if dependencies are being refactored:
DROP ASSEMBLY [YourAssemblyName] WITH NO CHECK;
  • If the assembly is registered via sys.trusted_assemblies (hash-based trust in newer CLR model), remove it:
EXEC sp_drop_trusted_assembly @hash = 0x<AssemblyHashValue>;

Step 3: Reconfigure CLR Strict Security and Trust Settings

  • Confirm CLR strict security is enabled (default in SQL Server 2025):
EXEC sp_configure 'clr strict security', 1;
RECONFIGURE;
  • Re-add the assembly as a trusted assembly using its SHA-512 hash instead of relying on database-level TRUSTWORTHY ON:
EXEC sp_add_trusted_assembly @hash = 0x<NewAssemblyHash>, @description = N'YourAssemblyName';
  • Avoid setting TRUSTWORTHY ON on user databases as a workaround; this is deprecated for CLR trust in favor of the trusted assembly hash model.

Step 4: Reinstall the Assembly with Correct Permission Set

  • Re-run the CREATE ASSEMBLY statement using the correct PERMISSION_SET:
CREATE ASSEMBLY [YourAssemblyName]
FROM 'C:\Path\To\YourAssembly.dll'
WITH PERMISSION_SET = SAFE;
  • Ensure the file path is accessible to the SQL Server service account (check NTFS permissions on Windows Server 2025 under C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Binn\).

Step 5: Restart SQL Server Service and Clear Cached Metadata

  • Restart the SQL Server service via Services.msc or PowerShell:
Restart-Service -Name 'MSSQLSERVER' -Force
  • This clears any cached assembly policy state held in memory from the failed installation attempt.

Alternative or Verification Steps

  • Verify success by querying sys.assemblies again and confirming the assembly shows is_visible = 1 with no error on subsequent CREATE PROCEDURE or CREATE FUNCTION calls referencing it.
  • If the issue persists, drop the database’s CLR-related cache entirely by running DBCC FREESYSTEMCACHE('ALL'), then repeat Steps 2–4 from a fresh SSMS session with elevated (sysadmin) privileges.