How to fix Error 7873 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 7873 – Built-in Endpoint Cannot Be Dropped

Why This Error Happens

Error 7873 occurs when an administrator or an automated deployment script attempts to execute a DROP ENDPOINT statement against one of SQL Server’s system-defined endpoints, such as TSQL Local Machine, TSQL Default TCP, or TSQL Default VIA. These built-in Transact-SQL endpoints are protected by the Database Engine because they are required for core connectivity (Shared Memory, TCP/IP, and VIA protocols) and cannot be removed via T-SQL DDL commands. Instead, SQL Server expects protocol-level changes—like disabling a protocol entirely—to be managed through SQL Server Configuration Manager rather than through the DROP ENDPOINT syntax.

Step-by-Step Resolution Guide

Step 1: Identify the Endpoint Causing the Conflict

  • Run the following query in SSMS to list all endpoints and confirm which one is “built-in”:
SELECT name, protocol_desc, type_desc, state_desc, is_admin_endpoint 
FROM sys.endpoints;
  • Look for name values like TSQL Local Machine, TSQL Named Pipes, TSQL Default TCP, or TSQL Default VIA—these are system-reserved and will trigger Error 7873 if targeted by DROP ENDPOINT.

Step 2: Stop Using DROP ENDPOINT for Protocol Management

  • Remove or comment out any DROP ENDPOINT [TSQL Default TCP] (or similar) statements from your deployment/configuration scripts.
  • Understand that built-in endpoints are tied directly to the protocol stack and are managed exclusively via Configuration Manager, not T-SQL.

Step 3: Use SQL Server Configuration Manager to Adjust Protocols

  • Open SQL Server Configuration Manager (search for SQLServerManager17.msc via Run on Windows Server 2025/Windows 11, adjusting the version number as needed for SQL Server 2025).
  • Navigate to SQL Server Network Configuration > Protocols for [Your Instance Name].
  • Right-click the protocol you wish to disable (e.g., TCP/IP, Named Pipes, or VIA) and select Disable instead of attempting to drop the endpoint via T-SQL.
  • Restart the SQL Server service for the changes to take effect:
Restart-Service -Name 'MSSQLSERVER' -Force

Step 4: Apply Granular Security Instead of Deletion (If Goal Was Restricting Access)

  • If your original intent was to restrict access rather than delete the endpoint, use DENY CONNECT on the endpoint for specific logins instead:
DENY CONNECT ON ENDPOINT::[TSQL Default TCP] TO [DomainName\UserAccount];
  • This achieves access control without violating the protected system object rules that trigger Error 7873.

Alternative or Verification Steps

  • Verify the Fix: Re-run SELECT name, state_desc FROM sys.endpoints; and confirm the protocol state shows as Stopped or Disabled (via Configuration Manager) rather than attempting removal; connectivity tests via sqlcmd -S servername\instance should now reflect the restricted protocol behavior.
  • Alternative Approach: If you only need to prevent external access while keeping the endpoint technically intact, configure Windows Firewall rules on Windows Server 2025 to block the relevant port (e.g., TCP 1433) rather than modifying the endpoint at the SQL Server layer.