How to fix Error 8509 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 8509 – MS DTC Transaction Import Failed

Why This Error Happens

Error 8509 occurs when SQL Server 2025 attempts to enlist a transaction with the Microsoft Distributed Transaction Coordinator (MS DTC) but the import fails due to a misconfigured or disabled DTC service, blocked network communication between participating servers, or insufficient security permissions on the DTC component. This is commonly caused by the “Network DTC Access” setting being disabled, firewall rules blocking RPC ports required by DTC, or authentication mismatches (such as “No Authentication Required” vs. “Mutual Authentication”) between the two systems involved in the distributed transaction. In some cases, a corrupted DTC configuration in the registry or CID (Component Identifier) conflicts between servers can also trigger this failure.

Step-by-Step Resolution Guide

Step 1: Enable and Configure Network DTC Access

  • Open Component Services (comexp.msc) on both the SQL Server and the remote server involved in the transaction.
  • Navigate to Component Services > Computers > My Computer > Distributed Transaction Coordinator > Local DTC.
  • Right-click Local DTC, select Properties, and go to the Security tab.
  • Check Network DTC Access, Allow Remote Clients, Allow Inbound/Outbound, and set Transaction Manager Communication to Mutual Authentication Required (or No Authentication Required only in trusted/test environments).
  • Restart the MS DTC service after applying changes.

Step 2: Open Required Firewall Ports

  • Ensure that RPC Endpoint Mapper (TCP port 135) is open on both Windows Server 2025 and Windows 11 machines.
  • Allow the msdtc.exe process through Windows Defender Firewall:
  netsh advfirewall firewall add rule name="MSDTC" program="%windir%\System32\msdtc.exe" action=allow
  • If using a dynamic RPC port range, confirm the range is open by checking:
  netsh int ipv4 show dynamicport tcp
  • Restart the Distributed Transaction Coordinator service after firewall changes.

Step 3: Verify Service Account Permissions

  • Open services.msc and confirm the Distributed Transaction Coordinator service is running under the Network Service account (default and recommended).
  • Ensure this account has the “Impersonate a client after authentication” and “Act as part of the operating system” user rights via secpol.msc under Local Policies > User Rights Assignment.
  • If SQL Server is running under a custom service account, confirm it has db_owner or appropriate rights to initiate distributed transactions.

Step 4: Synchronize DTC Configuration Between Servers

  • On both machines, confirm the DTC security settings (Step 1) are identical to avoid authentication mismatches.
  • If using a cluster or AlwaysOn Availability Group, verify that a dedicated Clustered MSDTC resource is configured and online in Failover Cluster Manager.
  • Restart MS DTC service on all nodes:
  net stop msdtc && net start msdtc

Step 5: Rebuild DTC Configuration (If Corrupted)

  • If the issue persists, reset the DTC log and configuration:
  msdtc -uninstall
  msdtc -install
  • Restart the server to fully reinitialize the DTC service and registry keys.

Alternative or Verification Steps

  • Use the DTCPing tool or run a test distributed transaction via BEGIN DISTRIBUTED TRANSACTION in SSMS to confirm successful enlistment between servers.
  • Check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > DistributedTransactionCoordinator for confirmation that no further MSDTC-related errors are logged after applying the fix.