SQL Server Error 15434

Error number

15434

Severity

16 (user-correctable error)

State

1

Product

Microsoft SQL Server Database Engine

Versions

All supported SQL Server versions (2016 to 2025), Azure SQL Managed Instance

Category

Logins & Permissions

Last reviewed

24 October 2026

What it means

Error 15434 means DROP LOGIN was refused because at least one session is still connected with that login; end those sessions first, then drop it.

SQL Server will not remove a login while a session that authenticated as that login is still open, because the session would be left running under a principal that no longer exists. DROP LOGIN checks for such sessions and stops with 15434 at severity 16; the login is unchanged. A sleeping connection in an application connection pool counts just as much as a running query.

The quoted name is the login being dropped. The sessions are visible in sys.dm_exec_sessions (column login_name). In our test, a session sitting in WAITFOR blocked the drop, and the identical DROP LOGIN worked as soon as that session disconnected.

Common causes

• An application, service or connection pool still holds connections opened with the login (pooled connections stay open after the application "closes" them).
• A person has a SQL Server Management Studio window, Object Explorer or another tool connected as that login.
• A SQL Server Agent job step, linked server or replication agent connects with the login on a schedule.
• A cleanup script drops the login immediately after the last use, before the connection has actually closed.

Diagnose it

Read-only These queries only read metadata and dynamic management views. They do not change data, permissions or configuration, so they are safe to run first.

SELECT session_id, login_name, host_name, program_name, status, last_request_end_time
FROM sys.dm_exec_sessions
WHERE login_name = N'app_login';

SELECT r.session_id, r.status, r.command, r.start_time, r.database_id
FROM sys.dm_exec_requests AS r
JOIN sys.dm_exec_sessions AS s ON s.session_id = r.session_id
WHERE s.login_name = N'app_login';

SELECT name, type_desc, is_disabled, create_date, modify_date
FROM sys.server_principals
WHERE name = N'app_login';

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

ALTER LOGIN [app_login] DISABLE;

-- for each session_id returned by the diagnostic:
KILL 52;

DROP LOGIN [app_login];

-- In each database where the login had a user
DROP USER IF EXISTS [app_login];

Examples

Dropping a login while a session is connected with it

Reproduced with two sqlcmd sessions and a temporary SQL login. Session 1 logs in as the login; session 2, an administrator, tries to drop it.

-- Session 1 (logged in as app_login):
WAITFOR DELAY '00:00:08';

-- Session 2 (administrator), while session 1 is still connected:
SELECT session_id, login_name, status
FROM sys.dm_exec_sessions
WHERE login_name = N'app_login';   -- one row, status running

DROP LOGIN [app_login];

Msg 15434, Level 16, State 1, Line 1
Could not drop login 'app_login' as the user is currently logged in.

How to prevent it

Retire a login in steps: find its sessions, switch the applications to their new login, disable the old login and watch for failed logins (error 18456) for a while, then drop it. A disabled login cannot reconnect, so the final drop does not race new connections.

Give every application its own login, so the program_name and host_name of its sessions identify exactly who would be affected. The same "still in use" rule applies to databases: see error 3702.

Common questions

Learn more on CodeWithSQL

• SQL Server security: logins, users and permissions

Official documentation

• DROP LOGIN (Transact-SQL)
• ALTER LOGIN (Transact-SQL)
• Database engine events and errors 15000 to 15999 (Microsoft Learn)

Last technically reviewed 24 October 2026; examples and diagnostics run on SQL Server 2025 (17.0.1145.4). Message text checked against the engine's sys.messages catalogue.