How to fix Error 835 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 835 – Failed Creating Event for Sparse File Operation

Why This Error Happens

Error 835 occurs when SQL Server 2025 attempts to create a Windows event object associated with a sparse file operation (commonly tied to database snapshots or Hekaton/In-Memory OLTP checkpoint files) but the underlying operating system call fails. This is typically caused by insufficient system resources (handle or kernel object exhaustion), restrictive security/group policy settings on the SQL Server service account, or the target file path residing on a volume with filesystem-level corruption or incompatible configuration (such as a non-NTFS/ReFS volume or a volume with sparse file support disabled). In rare cases, this is also triggered by antivirus or EDR software intercepting and blocking low-level event handle creation on the file.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Service Account Permissions

  • Open Services.msc and confirm which account runs the SQL Server (MSSQLSERVER) service.
  • Ensure this account has Full Control NTFS permissions on the data/log directory and the directory referenced in the error message (check the %ls file path in the full error text).
  • Confirm the account has the “Create global objects” user right via secpol.msc → Local Policies → User Rights Assignment.
  • Restart the SQL Server service after any permission changes:
  net stop MSSQLSERVER && net start MSSQLSERVER

Step 2: Check System Resource and Kernel Handle Limits

  • Open Performance Monitor (perfmon.exe) and monitor the Process > Handle Count counter for sqlservr.exe.
  • Check Windows Event Viewer under System and Application logs for correlating Kernel-Event-Tracing or resource exhaustion warnings at the same timestamp as Error 835.
  • If handle counts are abnormally high, identify runaway sessions or snapshot files using:
  SELECT * FROM sys.dm_os_memory_objects WHERE type = 'MEMOBJ_SOSOS';
  • Increase available system resources or reboot the Windows Server 2025 host if exhaustion is confirmed.

Step 3: Validate the File System and Sparse File Support

  • Confirm the volume hosting the file in the error message is formatted as NTFS or ReFS (sparse files are not supported on FAT32/exFAT).
  • Run chkdsk against the affected volume to rule out corruption:
  chkdsk D: /f /r
  • If the file resides on a database snapshot sparse file (.ss file), drop and recreate the snapshot:
  DROP DATABASE [Snapshot_Name];

Step 4: Exclude SQL Server Directories from Antivirus/EDR Scanning

  • Add exclusions in Windows Defender or third-party antivirus for:
  • SQL Server data/log directories (e.g., C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\)
  • The sqlservr.exe process itself
  • Use PowerShell to add a Defender exclusion:
  Add-MpPreference -ExclusionPath "C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA"

Step 5: Apply the Latest Cumulative Update for SQL Server 2025

  • Check the currently installed build version:
  SELECT @@VERSION;
  • Download and install the latest Cumulative Update (CU) from the Microsoft Update Catalog, as this error has known fixes related to sparse file event handling in early SQL Server 2025 builds.
  • Reboot the server after patching to ensure kernel-level drivers are refreshed.

Alternative or Verification Steps

  • After applying fixes, re-run the operation that triggered Error 835 (e.g., snapshot creation or In-Memory OLTP checkpoint) and monitor the SQL Server Error Log (ERRORLOG) for recurrence.
  • If the error persists, run SQLIOSim or DBCC CHECKDB against the affected database to rule out deeper I/O subsystem or corruption issues, and review the Windows System Event Log for matching disk or kernel-level error codes (e.g., Event ID 7 or 153).