How to fix Error 8559 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 8559 – RegSetValueEx Registry Write Failure

Why This Error Happens

Error 8559 occurs when the SQL Server service account lacks sufficient permissions to write to the specified registry key, typically under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server. This commonly happens after a Windows Server 2025 security update tightens registry ACLs, during a botched SQL Server installation/repair, or when Group Policy objects (GPOs) overwrite local registry permissions. It can also surface when the registry key itself has become corrupted or when antivirus/EDR software is actively blocking registry write operations from sqlservr.exe.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Service Account Permissions

  • Open Registry Editor (regedit.exe) as an Administrator on the Windows Server 2025 / Windows 11 machine.
  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server.
  • Right-click the relevant key (named in the error message) and select Permissions.
  • Confirm the SQL Server service account (e.g., NT Service\MSSQLSERVER or your custom domain service account) has Full Control.

Step 2: Reset Registry Key Ownership and ACLs

  • If the service account is missing or grayed out, click Advanced in the Permissions dialog.
  • Change the Owner field to the SQL Server service account or local Administrators group.
  • Enable “Replace owner on subcontainers and objects” and apply the change.
  • Re-add the service account with Full Control and propagate permissions to child objects.

Step 3: Check for Conflicting Group Policy or AppLocker Restrictions

  • Run gpresult /h gpreport.html to generate a report of applied policies on the server.
  • Look for any Registry Restriction Policies or AppLocker rules that may be blocking RegSetValueEx calls for sqlservr.exe.
  • Temporarily disable the suspected GPO and run gpupdate /force, then restart the SQL Server service to test.

Step 4: Exclude SQL Server from Antivirus/EDR Scanning

  • Add exclusions for sqlservr.exe, sqlagent.exe, and the MSSQL\DATA folder in your antivirus or Windows Defender configuration.
  • Use PowerShell to add exclusions quickly:
  Add-MpPreference -ExclusionProcess "C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Binn\sqlservr.exe"
  • Restart the SQL Server service and attempt the failing operation again.

Step 5: Repair the SQL Server Installation

  • If registry corruption persists, launch SQL Server Installation Center from the installation media.
  • Select Maintenance > Repair and choose the affected instance.
  • Allow the repair wizard to rebuild registry keys and reapply correct ACLs automatically.

Alternative or Verification Steps

  • After applying fixes, open SQL Server Configuration Manager, restart the instance, and check the SQL Server Error Log for the absence of Error 8559 on startup.
  • As an alternative, use Process Monitor (Sysinternals) filtered on sqlservr.exe and result ACCESS DENIED to pinpoint the exact registry path still causing failures.