Clear, practical technology insights BSOD Code Lookup · Windows Error Code Lookup · Wi-Fi Troubleshooting · PC Troubleshooting Checklist

How to Reset a Lost sa Password in SQL Server

Recover SQL Server administrator access safely with Windows Authentication or single-user mode, then reset or disable the sa login without editing master.mdf.

Table of Contents

If you have forgotten the SQL Server sa password, do not edit master.mdf or use an unofficial password-removal utility. The supported recovery path is to sign in with another sysadmin login or, if every administrator is locked out, start the Database Engine in single-user mode and connect as a Windows local administrator.

This procedure causes a short outage. Use it only on an instance you are authorized to administer. Record the instance and service names, confirm that current database backups are available, and schedule downtime before continuing.

First try an existing sysadmin login

Open SQL Server Management Studio and connect with Windows Authentication using an account that already belongs to the sysadmin fixed server role. If that works, run the following in a new query window, replacing the placeholder with a strong, unique password:

ALTER LOGIN sa WITH PASSWORD = '<StrongUniquePassword>' UNLOCK;
ALTER LOGIN sa ENABLE;
GO

If the application does not require sa, a named administrative login and Windows Authentication are safer choices. Microsoft notes that sa is well known and commonly targeted; keep it disabled unless it is genuinely required.

Recover access with single-user mode

Use these steps when no working SQL Server sysadmin login remains. Microsoft’s locked-out administrator recovery guide documents this supported method.

1. Sign in to Windows as a local administrator

Use an account in the computer’s local Administrators group and open Command Prompt as administrator. On a managed server or cluster, follow the organization’s change procedure rather than improvising on a production node.

2. Stop clients and SQL Server Agent

Single-user mode permits only one connection. Stop SQL Server Agent and any monitoring, backup, or application service that may connect automatically; otherwise it can take the only available session.

3. Stop the Database Engine service

For a default instance, the service display name is normally SQL Server (MSSQLSERVER). A named instance appears as SQL Server (InstanceName). You can stop it in SQL Server Configuration Manager or with an elevated command:

net stop "SQL Server (MSSQLSERVER)"

Replace MSSQLSERVER with the actual instance name when necessary.

4. Start the instance for sqlcmd only

Restricting the single connection to SQLCMD helps prevent another program from taking it:

net start "SQL Server (MSSQLSERVER)" /m"SQLCMD"

The application name is case-sensitive in this startup option. Microsoft provides additional details in its single-user mode documentation.

5. Connect with Windows Authentication

For a default local instance, run:

sqlcmd -S localhost -E

For a named instance, use sqlcmd -S localhost\InstanceName -E. If sqlcmd is not installed or is not on the PATH, install the supported Microsoft command-line tools before the maintenance window.

6. Reset or avoid the sa login

To reset and enable sa, execute:

ALTER LOGIN sa WITH PASSWORD = '<StrongUniquePassword>' UNLOCK;
ALTER LOGIN sa ENABLE;
GO

A better recovery for many environments is to restore a named Windows administrator instead:

CREATE LOGIN [DOMAIN\UserName] FROM WINDOWS;
ALTER SERVER ROLE sysadmin ADD MEMBER [DOMAIN\UserName];
GO

Replace the sample identity with the authorized Windows user or group. Type EXIT when finished.

7. Restart normally and test

Stop the Database Engine, start it again without the /m option, and restart SQL Server Agent and any services you stopped. Test the intended administrator login, review the SQL Server error log, and confirm application connectivity.

If sa still cannot connect

  • Confirm the instance uses mixed mode if you intend to use SQL Server Authentication. Changing authentication mode requires a Database Engine restart.
  • Check that sa is enabled and not locked out.
  • Verify the server and instance name rather than repeatedly testing against a different instance.
  • Do not confuse the sa password with the Windows account used to run the SQL Server service.

For broader database background, compare relational systems with this SQL and NoSQL overview. Readers building their SQL skills can also use this collection of free data-learning resources.

Discussion

Reader Comments 0

Sign in with email or Google to join the discussion.