Fix XACT_E_COMMITPREVENTED (0x8004D003) in SQL Server

Quick Answer

Run net stop msdtc then net start msdtc on both servers. Then check that MS DTC is set to 'Allow Inbound' and 'Allow Outbound' with 'Enable Transaction Manager Communication' turned on.

What's Happening

You're running a query that spans two SQL Servers — a linked server transaction. The commit command can't finish because the Distributed Transaction Coordinator (MS DTC) on one side isn't talking back correctly. The error comes from the Microsoft Distributed Transaction Coordinator service. It's not a SQL Server problem, even though it shows up in SSMS.

I see this most often when someone sets up a linked server between SQL Server 2019 on Windows Server 2019 and an older SQL Server 2016 on Windows Server 2012 R2. A firewall update or a Windows update broke the DTC communication.

Fix Steps

1. Stop and restart MS DTC on both servers.

   On Server A (the one where you run the query):

   net stop msdtc

   Then:

   net start msdtc

   Do the same on Server B (the linked server target). After restarting, try your transaction again. This clears any stuck state.

2. Check MS DTC security settings.

   Open Component Services (run dcomcnfg). Go to Component Services > Computers > My Computer > Distributed Transaction Coordinator > Local DTC. Right-click Local DTC, choose Properties. Click the Security tab.

   Set these:

   • Check Allow Inbound
   • Check Allow Outbound
   • Check Enable Transaction Manager Communication
   • Under Authentication, pick No Authentication Required

   Click Apply, then OK. A popup says "The MS DTC service will be stopped and restarted." Let it do that.

3. Open firewall ports for MS DTC.

   MS DTC uses two port ranges. The default is 135 (RPC endpoint mapper) and 5000-5500 (for DTC communication). On both servers, run this PowerShell as admin:

   New-NetFirewallRule -DisplayName "MS DTC RPC" -Direction Inbound -LocalPort 135 -Protocol TCP -Action Allow
   New-NetFirewallRule -DisplayName "MS DTC Communication" -Direction Inbound -LocalPort 5000-5500 -Protocol TCP -Action Allow
   New-NetFirewallRule -DisplayName "MS DTC Outbound" -Direction Outbound -LocalPort 135 -Protocol TCP -Action Allow
   New-NetFirewallRule -DisplayName "MS DTC Outbound Comm" -Direction Outbound -LocalPort 5000-5500 -Protocol TCP -Action Allow

   If you're using Windows Firewall with Advanced Security, you can also do this through the GUI: Inbound Rules > New Rule > Port > TCP > Specific local ports: 135,5000-5500 > Allow the connection.

4. Test the DTC communication.

   Download and run the DTCPing tool from Microsoft (it's in the Windows SDK). Run it on both servers. It tests if DTC can talk to the other server. It should report "Transaction succeeded" for both directions.

Alternative Fixes

If the steps above don't work, try these:

• Reboot both servers. I know it sounds basic, but DTC can get in a state where a service restart won't fix it. A full reboot clears the DTC log and resets network connections.
• Remove and recreate the linked server. Run this on the source server:

EXEC sp_dropserver 'YourLinkedServerName';
GO
EXEC sp_addserver 'YourLinkedServerName', 'YourServerInstance';
GO

Then reconfigure the linked server with the correct credentials.

• Check for antivirus blocking. Some antivirus software blocks DTC ports. Temporarily disable the antivirus on both servers and test. If it works, add exceptions for ports 135 and 5000-5500 in the antivirus.

Prevention Tips

To avoid this in the future:

• Set MS DTC to start Automatic on both servers. Run sc config msdtc start= auto on each.
• Make a GPO rule to always allow inbound and outbound DTC traffic on port 135 and a static range like 5000-5500.
• If you use a third-party firewall (like Palo Alto or Fortinet), create an application override for "msdtc" and set it to allow both inbound and outbound.
• After any Windows update that includes "Distributed Transaction Coordinator" or "RPC" in the KB name, test your distributed transactions. Windows updates have broken DTC before.

One thing people miss: MS DTC needs the same security settings on both servers. If one side has "Mutual Authentication Required" and the other has "No Authentication Required", the commit gets blocked. Keep both on "No Authentication Required" for simplicity.