How to fix Error 9698 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 9698 — Cannot Start Service Broker Security Manager

Why This Error Happens

This error occurs when SQL Server’s Service Broker component fails to initialize its security manager during startup, typically due to a corrupted or inaccessible master key, certificate issues tied to the Service Broker endpoint, or problems with the underlying cryptographic provider (such as Windows CNG or the local machine key store). It can also result from insufficient permissions on the SQL Server service account to access certificate stores or registry keys required for encryption operations. Because this error is a generic wrapper, the actual root cause is almost always logged separately in the SQL Server error log or the Windows Application/System event logs immediately before or after this entry.

Step-by-Step Resolution Guide

Step 1: Review the SQL Server and Windows Event Logs

  • Open SQL Server Management Studio (SSMS) and navigate to Management > SQL Server Logs, or locate the log file directly at C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG.
  • Cross-reference timestamps with Windows Event Viewer under Windows Logs > Application and Windows Logs > System.
  • Look for related errors such as 9693 (certificate errors), 15466 (master key issues), or CNG/cryptographic provider failures that occurred just before Error 9698.

Step 2: Verify the Service Master Key and Database Master Key

  • Open a new query window in SSMS connected to the affected instance.
  • Run the following to check master key status:
  OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourPassword';
  • If the key is corrupted or missing, restore it from a backup using:
  RESTORE SERVICE MASTER KEY FROM FILE = 'C:\Backups\ServiceMasterKey.key' 
  DECRYPTION BY PASSWORD = 'YourPassword';
  • If no backup exists, you may need to regenerate it, understanding this will require re-encrypting dependent objects.

Step 3: Check SQL Server Service Account Permissions

  • Open Services.msc on Windows Server 2025/Windows 11 and confirm the account running the SQL Server service (e.g., NT Service\MSSQLSERVER).
  • Ensure this account has Full Control or at least Read access to:
  • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
  • The local machine certificate store (certlm.msc > Personal > Certificates)
  • Grant permissions via right-click > Properties > Security on the relevant certificate or key file, adding the service account explicitly.

Step 4: Validate the Service Broker Configuration

  • Run the following query to confirm Service Broker is enabled on the database:
  SELECT name, is_broker_enabled FROM sys.databases WHERE name = 'YourDatabaseName';
  • If disabled unexpectedly or showing inconsistent GUIDs, enable it with:
  ALTER DATABASE YourDatabaseName SET ENABLE_BROKER;
  • Restart the SQL Server service afterward to apply changes cleanly.

Step 5: Restart SQL Server Services and Dependent Components

  • Restart the SQL Server instance via Services.msc or using PowerShell:
  Restart-Service -Name 'MSSQLSERVER' -Force
  • Monitor the ERRORLOG in real-time during startup to confirm Error 9698 no longer appears.

Alternative or Verification Steps

  • To verify the fix, query sys.dm_broker_connections and sys.transmission_queue to confirm Service Broker is actively processing without errors.
  • If the issue persists after certificate and permission fixes, consider running DBCC CHECKDB on the master database to rule out system-level corruption, or rebuild the Service Master Key as a last resort using ALTER SERVICE MASTER KEY REGENERATE (note: this requires re-encrypting all dependent keys and certificates).