How to fix Error 8468 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 8468 – “Underlying Service Has Been Altered”

Why This Error Happens

Error 8468 occurs when SQL Server’s Database Mirroring or Availability Group endpoint detects a mismatch between the internal service metadata and the certificate or service principal bound to it. This typically happens after a service account change, an expired/renewed mirroring certificate, or a Windows Server/SQL Server cumulative update that altered the SQL Server service binary or its associated SID without updating the endpoint authentication mapping. Corrupted or orphaned endpoint metadata in the master database can also trigger this error when SQL Server validates the service identity at endpoint startup.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Service Account and SID

  • Open SQL Server Configuration Manager and confirm the service account under SQL Server Services has not changed unexpectedly.
  • Run the following query to check the current service master key and endpoint owner:
  SELECT * FROM sys.database_mirroring_endpoints;
  • Compare the principal_id against sys.server_principals to confirm alignment.

Step 2: Drop and Recreate the Mirroring/AG Endpoint

  • Script out the existing endpoint configuration before making changes:
  SELECT name, port, state_desc FROM sys.tcp_endpoints;
  • Drop the affected endpoint:
  DROP ENDPOINT [Mirroring];
  • Recreate it with the correct certificate and authentication mode:
  CREATE ENDPOINT [Mirroring]
  STATE = STARTED
  AS TCP (LISTENER_PORT = 5022)
  FOR DATABASE_MIRRORING (AUTHENTICATION = CERTIFICATE YourCertName, ROLE = ALL);

Step 3: Refresh the Mirroring Certificate

  • Navigate to C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\ and confirm certificate backup files are present and not expired.
  • If the certificate expired, regenerate it:
  CREATE CERTIFICATE Mirror_Cert
  WITH SUBJECT = 'Mirroring Certificate',
  START_DATE = '2025-01-01', EXPIRY_DATE = '2030-01-01';
  • Re-exchange the public key certificate with the partner/witness instance.

Step 4: Restart the SQL Server Service and Validate Windows Service Registration

  • Open Services.msc on Windows Server 2025 / Windows 11 and restart the SQL Server (MSSQLSERVER) service.
  • Confirm the service registry key at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVER has not been flagged as modified by Windows Update or a third-party agent.
  • Re-run sp_configure to confirm endpoint settings persist after restart.

Alternative or Verification Steps

  • Run SELECT * FROM sys.database_mirroring_endpoints; after the restart to confirm the endpoint state shows STARTED with no error flags.
  • If the error persists, fail over the Availability Group manually and rebuild the endpoint on the secondary replica using the same certificate thumbprint to rule out a corrupted local service binding.