How to fix Error 7895 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 7895 – Custom WSDL Stored Procedure Restricted to System Administrator

Why This Error Happens

This error occurs because SQL Server 2025 enforces strict role-based security on SOAP/WSDL endpoints, and the ALTER ENDPOINT statement specifying a custom WSDL stored procedure requires CONTROL SERVER permission, which is implicitly only granted to members of the sysadmin fixed server role. If the login executing the command is not a system administrator, or has been explicitly denied CONTROL SERVER permission through Group Policy-integrated security templates in Windows Server 2025, the endpoint configuration will fail with Error 7895. Additionally, this can happen if the SQL Server service account lacks the correct scope in Active Directory when endpoints are configured via Windows Authentication.

Step-by-Step Resolution Guide

Step 1: Verify Current Server Role Membership

  • Open SQL Server Management Studio (SSMS) 2025 and connect using an account known to have administrative rights.
  • Run the following query to check role membership for the login attempting the change:
  SELECT sp.name, sp.type_desc, sr.name AS RoleName
  FROM sys.server_role_members srm
  JOIN sys.server_principals sp ON srm.member_principal_id = sp.principal_id
  JOIN sys.server_principals sr ON srm.role_principal_id = sr.principal_id
  WHERE sr.name = 'sysadmin';
  • Confirm whether the specific login is missing from this result set.

Step 2: Elevate the Login to System Administrator (If Applicable)

  • If the user should have rights to manage WSDL endpoints, add them to the sysadmin role using:
  ALTER SERVER ROLE sysadmin ADD MEMBER [DOMAIN\Username];
  • Alternatively, if granting full sysadmin access is against your security policy, create a narrower custom server role, though note that native WSDL endpoint configuration via FOR SOAP specifically checks for sysadmin membership and may still block non-sysadmins regardless of granular permissions.

Step 3: Correct the ALTER ENDPOINT Syntax via an Elevated Session

  • Launch SSMS using “Run as Administrator” on Windows Server 2025 to ensure the Windows Authentication token carries the correct elevated session privileges.
  • Re-run the specific T-SQL command to attach the stored procedure to the endpoint:
  ALTER ENDPOINT MyWSDLEndpoint 
  FOR SOAP (
     WEBMETHOD 'MyMethod' (NAME = 'MyDatabase.dbo.MyStoredProcedure'),
     WSDL = DEFAULT
  );
  • Ensure there are no typos in the three-part naming convention (Database.Schema.Procedure), as a malformed name can sometimes trigger a false-positive permission error.

Step 4: Check Windows Server 2025 Local Security Policies

  • Navigate to Local Security Policy > Local Policies > User Rights Assignment.
  • Verify that the SQL Server service account has not been restricted from “Act as part of the operating system,” as this can interfere with the internal permission validation checks between the OS and the SQL Server security catalog.

Alternative or Verification Steps

  • Verification: After applying the fix, run SELECT * FROM sys.endpoints; to confirm the state_desc for your target endpoint reads as STARTED and attempt the WSDL call via a browser URL (e.g., http://servername/sql?wsdl) to ensure the schema loads without a 401/403 error.
  • Alternative: If elevating the user to sysadmin is not permissible under your organization’s compliance rules, have a current system administrator execute the ALTER ENDPOINT statement on behalf of the requesting user, as the underlying stored procedure association itself does not need to be re-run by the end-user daily.