SQL Server Msg 3201 — Why Is the Backup Job Failing to Write?
Diagnosing Msg 3201 via OS error codes (5 Access Denied, 3 Path Not Found, 112 Disk Full, 32 File Locked), service account NTFS rights, and UNC path requirements.
Operational Verification & Reliability Metadata
The error string is a symptom, not the root cause. Do not restart the server blindly. Run the diagnostic queries below to pinpoint the actual failure mode.
▸Symptom
Msg 3201, Level 16, State 1, Line 1
Cannot open backup device 'D:Backupapp_full.bak'.
Operating system error 5(Access is denied.).
Msg 3013, Level 16, State 1, Line 1
BACKUP DATABASE is terminating abnormally.The first sentence is standard boilerplate; the exact failure mode is dictated by the Operating system error code:
- •Error 5 — Access is denied: The SQL Server service account lacks NTFS write permissions on the target directory. The most frequent culprit.
- •Error 3 — The system cannot find the path specified: The folder path does not exist. SQL Server does not create directories recursively.
- •Error 112 — There is not enough space on the disk: The target volume is out of free storage.
- •Error 32 — The process cannot access the file because it is being used by another process: The backup file is locked by an antivirus scan, third-party backup agent, or a concurrent backup stream.
▸Critical Trap: Testing with Your Personal Admin Account
Being able to create files in D:Backup via Windows Explorer while logged in over RDP does not mean SQL Server can. The BACKUP DATABASE engine process executes strictly under the security context of the SQL Server Service Account, not your personal domain login!
Query the exact service account identity:
SELECT servicename, startup_type_desc, status_desc, service_account
FROM sys.dm_server_services;Grant NTFS Modify privileges to this account (NT Service\MSSQLSERVER, NT AUTHORITY\SYSTEM, or a managed domain service account).
▸Step-by-Step Resolution
1. Validate Target Paths Non-Destructively
BACKUP DATABASE app TO DISK = 'D:Backupapp_full.bak'
WITH COPY_ONLY, CHECKSUM;2. Standardize on UNC Network Paths (Never Mapped Drive Letters)
Mapped drive letters (Z:\) exist only within the interactive user logon session. SQL Server background services cannot see user-mapped drive letters. Always use UNC paths:
BACKUP DATABASE app TO DISK = '\\nas-storage\backups\app_full.bak'
WITH COPY_ONLY, COMPRESSION, CHECKSUM;Ensure the service account has rights on both the Network Share and the underlying NTFS Security tab.
3. Inspect for Concurrent File Locks (Error 32)
Identify active backup operations:
SELECT r.session_id, r.command, r.start_time, r.percent_complete,
t.text AS sql_statement
FROM sys.dm_exec_requests r
CROSS APPLY sys.dm_exec_sql_text(r.sql_handle) t
WHERE r.command LIKE '%BACKUP%' OR r.command LIKE '%RESTORE%';Ensure corporate endpoint antivirus engines exclude .bak, .trn, and .mdf/.ldf extensions from real-time file-locking inspection.
4. Validate Backup Header Integrity
RESTORE VERIFYONLY FROM DISK = 'D:Backupapp_full.bak' WITH CHECKSUM;▸Related Error Guides & Hub Links
- •SQL Server Transaction Log Full 9002 (H-12) — Log truncation and disk exhaustion
- •SQL Server Filegroup Full (H-29) — Database data file capacity limits
- •SQL Server Hub — Disaster recovery and automated backup runbooks
Other Database Error Triage Playbooks
Other battle-tested diagnostic guides for high-severity database errors.
SQL Server Error 18456: Root Cause by State Code Matrix
In Error 18456, the State code reveals the actual root cause. Specific fixes for State 5, 8, 11, 18, 38, and 40, with ERRORLOG extraction scripts.
SQL Server Error 1205 Deadlock: Graph Extraction and Prevention
Extracting the deadlock graph from the system_health Extended Events ring buffer, understanding victim election, and architectural resolution.
SQL Server Pool Timeout: Connection Pool Exhaustion Fix
Difference between connection pool timeout and query command timeout, detecting connection leaks, and .NET DbContext architectural fixes.