SQL Server Error 35250

Error number

35250

Severity

16 (user-correctable error)

State

Not documented by Microsoft (not reproduced here)

Product

Microsoft SQL Server Database Engine

Versions

SQL Server 2016 to 2025 with Always On availability groups (including distributed availability groups)

Category

High Availability

Last reviewed

23 October 2026

What it means

Error 35250 means a secondary replica could not talk to the primary replica through the availability group endpoint, so a command that needs the primary (typically joining a database to the group) was refused.

Replicas in an availability group talk to each other over the database mirroring endpoint (TCP port 5022 by default), not over the normal client port. When you join a secondary database, or run another command that needs the primary, the secondary checks its connection to the primary first. If that connection is not established, it raises 35250. Microsoft documents this mainly for joining secondary databases when the endpoint cannot be reached.

So the message is about server-to-server networking and security, not about your own connection: you can be connected to both servers in SSMS and still get it. The real cause is usually recorded in sys.dm_hadr_availability_replica_states (last_connect_error_description) and in the error log on both replicas, for example a DNS lookup failure, a blocked port or an endpoint login that is refused.

Common causes

• The endpoint port (5022 by default) is blocked by a Windows firewall, network firewall or cloud security group between the replicas, in either direction.
• The endpoint_url defined for a replica has the wrong host name, IP address or port, or the name does not resolve correctly (DNS or a stale HOSTS file entry).
• The database mirroring endpoint is stopped, or another process or instance holds the port.
• The service account of the other replica has no CONNECT permission on the endpoint (or the certificates used for endpoint authentication do not match).
• The replicas are still connecting after a restart or failover, or a known product issue fixed in a later cumulative update.

Diagnose it

Read-only These queries only read metadata and dynamic management views. They do not change data, permissions or configuration, so they are safe to run first.

SELECT r.replica_server_name, r.endpoint_url, rs.role_desc, rs.connected_state_desc,
       rs.last_connect_error_number, rs.last_connect_error_description,
       rs.last_connect_error_timestamp
FROM sys.dm_hadr_availability_replica_states AS rs
JOIN sys.availability_replicas AS r ON rs.replica_id = r.replica_id;

SELECT e.name, e.state_desc, e.role_desc, t.port, t.ip_address,
       e.connection_auth_desc, e.encryption_algorithm_desc
FROM sys.database_mirroring_endpoints AS e
JOIN sys.tcp_endpoints AS t ON t.endpoint_id = e.endpoint_id;

SELECT ep.name AS endpoint_name, pr.name AS grantee, pr.type_desc,
       pe.permission_name, pe.state_desc
FROM sys.server_permissions AS pe
JOIN sys.endpoints AS ep ON ep.endpoint_id = pe.major_id
JOIN sys.server_principals AS pr ON pr.principal_id = pe.grantee_principal_id
WHERE pe.class_desc = N'ENDPOINT' AND ep.type = 4;

EXEC sp_readerrorlog 0, 1, N'endpoint';

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

# PowerShell on each replica
Test-NetConnection -ComputerName SQL01.contoso.com -Port 5022
Resolve-DnsName -Name SQL01.contoso.com

ALTER AVAILABILITY GROUP SalesAg
MODIFY REPLICA ON N'SQL02'
WITH (ENDPOINT_URL = N'TCP://SQL02.contoso.com:5022');

-- on a replica whose endpoint is stopped
ALTER ENDPOINT Hadr_endpoint STATE = STARTED;

GRANT CONNECT ON ENDPOINT::Hadr_endpoint TO [CONTOSO\svc_sql02];

Examples

Joining a secondary database when the primary cannot be reached

Shown as documented by Microsoft (MSSQLSERVER_35250); not reproduced here because it needs an availability group. The state is the commonly reported one. The statement runs on the secondary replica after the database was restored there WITH NORECOVERY.

-- On the secondary replica SQL02
ALTER DATABASE SalesDb SET HADR AVAILABILITY GROUP = SalesAg;

The connection to the primary replica is not active. The command cannot be processed.

How to prevent it

Before creating an availability group, test the endpoint port and name resolution in both directions between every pair of replicas, and script the endpoints, logins and CONNECT grants so every replica is set up the same way. Use fully qualified names in endpoint URLs.

Monitor connected_state_desc and last_connect_error_description for every replica, so a broken replica connection is found before a join or a failover depends on it.

Common questions

Learn more on CodeWithSQL

• SQL Server security: logins, users and permissions

Official documentation

• MSSQLSERVER_35250 (Microsoft Learn)
• Troubleshoot Always On availability groups configuration
• Join a secondary database to an availability group
• The database mirroring endpoint

Last technically reviewed 23 October 2026; examples and diagnostics run on SQL Server 2025 (17.0.1145.4). Message text checked against the engine's sys.messages catalogue.