How to fix Error 9649 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 9649 (SSPI Error in Service Broker)

Why This Error Happens

Error 9649 occurs when SQL Server’s Service Broker attempts to establish a secure dialog with another Service Broker instance but fails during the Kerberos/NTLM authentication handshake. This is typically caused by missing or misconfigured Service Principal Names (SPNs), a broken trust relationship between the client and target machine accounts in Active Directory, or the SQL Server service account lacking sufficient permissions to register or validate SPNs. It can also stem from clock skew between servers, DNS resolution failures, or firewall rules blocking the Kerberos ports (TCP/UDP 88) needed for ticket exchange.

Step-by-Step Resolution Guide

Step 1: Verify and Register the Service Principal Name (SPN)

  • Open an elevated Command Prompt on the SQL Server host.
  • Run setspn -L <DomainAccount> to list existing SPNs for the SQL Server service account.
  • If the SPN is missing, register it manually using setspn -S MSSQLSvc/<FQDN>:<Port> <DomainAccount>.
  • Ensure there are no duplicate SPNs registered under a different account using setspn -X.

Step 2: Check Active Directory Trust and Account Permissions

  • Confirm the SQL Server service account has “Validated write to service principal name” permission delegated in Active Directory Users and Computers (ADUC).
  • Verify the computer account or service account is not disabled or expired.
  • Ensure both the local and remote SQL Server instances are part of the same domain or a trusted domain relationship exists.

Step 3: Synchronize System Clocks and Validate DNS

  • Check the time difference between the two servers using w32tm /stripchart /computer:<RemoteServer>.
  • Kerberos authentication fails if clock skew exceeds 5 minutes by default; resync using w32tm /resync on both nodes.
  • Run nslookup <RemoteServerFQDN> from both machines to confirm forward and reverse DNS lookups resolve correctly.

Step 4: Review Windows Security Event Logs

  • Open Event Viewer and navigate to Windows Logs > System and Windows Logs > Security.
  • Filter for Event ID 4 (Kerberos) or LSASRV errors occurring at the same timestamp as the SQL Error 9649.
  • Cross-reference the specific SSPI/Kerberos error code returned (e.g., KRBAPERR_MODIFIED) to pinpoint whether it is a password mismatch or ticket corruption issue.

Step 5: Restart Services and Clear Kerberos Ticket Cache

  • Restart the SQL Server (MSSQLSERVER) service to force re-registration of the SPN if “Instant File Initialization” or domain changes were recently applied.
  • Clear the local Kerberos ticket cache using klist purge on the client machine.
  • Restart the Netlogon service on the Domain Controller if trust relationship errors persist.

Alternative or Verification Steps

  • To verify the fix, initiate a Service Broker conversation between the two endpoints and monitor the sys.transmission_queue table for a drop in connection errors.
  • If SSPI errors persist despite correct SPNs, bypass Kerberos by configuring Service Broker to use NTLM authentication or force a specific authentication mode via the ENCRYPTION clause in the CREATE ENDPOINT statement.