Reset Lost SQL Server SA Password: Step-by-Step

Losing the SQL Server sa password can lock you out of your databases, but you can regain access by starting SQL Server in single-user mode and connecting as a local administrator. This guide walks you through the exact steps to reset the sa password on Windows, covering SQL Server 2012 through 2022. You’ll need Windows administrator rights on the server and the ability to stop and start Windows services.

What You’ll Need

Windows administrator account on the SQL Server machine.
Access to the SQL Server Configuration Manager or Services console.
SQL Server Management Studio (SSMS) or sqlcmd command-line tool.
Knowledge of the SQL Server instance name (e.g., MSSQLSERVER for default, or a named instance).

Step-by-Step

Stop the SQL Server service. Open Services (Win+R, type services.msc). Find the service named SQL Server (MSSQLSERVER) or SQL Server (YourInstanceName). Right-click and select Stop.
Start SQL Server in single-user mode. Open SQL Server Configuration Manager (search for it in the Start menu). In the left pane, click SQL Server Services. In the right pane, right-click your SQL Server service and choose Properties. Go to the Startup Parameters tab. In the Specify a startup parameter box, type -m and click Add. Click OK. (Alternatively, you can run net start MSSQLSERVER /m from an elevated command prompt, but the Configuration Manager method is more reliable.)
Start the service. Right-click the service again and select Start. Wait for it to start; it may take a few seconds.
Connect as a local administrator. Open SQL Server Management Studio (SSMS). In the Connect to Server dialog, set Server type to Database Engine, Server name to your instance name (e.g., localhost or localhost\SQLEXPRESS), and Authentication to Windows Authentication. Click Connect. Because SQL Server is in single-user mode, only one connection is allowed—make sure no other connections are active (like from an application).
Reset the sa password. In the Object Explorer, expand Security and then Logins. Right-click sa and choose Properties. In the Login Properties dialog, enter a new password in both Password and Confirm password fields. Optionally, uncheck Enforce password policy if you want a simple password for testing. Click OK.
Exit single-user mode. Close SSMS completely. Then, in SQL Server Configuration Manager, go back to the service Properties → Startup Parameters tab, select the -m parameter, and click Remove. Click OK.
Restart the service normally. Right-click the service and select Restart. This applies the normal startup parameters.
Test the sa login. Open SSMS again and connect using SQL Server Authentication with the sa login and your new password. If it connects, you’re done.

Common Mistakes

Not removing the -m parameter. If you forget to remove it, SQL Server will remain in single-user mode, and only one connection at a time will be allowed, causing issues for applications.
Another connection is active. Single-user mode allows only one connection. If an application or a monitoring tool is connected, you’ll get an error. Stop any SQL Server agents or applications before connecting.
Using the wrong instance name. If you have a named instance, the service name and server name in SSMS must match exactly (e.g., localhost\SQLEXPRESS).
Not running SSMS as administrator. While not always required, running SSMS with elevated privileges can avoid permission issues when connecting in single-user mode.

Tips

Always back up your databases before performing this procedure, especially if the server is in production.
Use a strong password for the sa account and store it in a secure password manager.
Consider disabling the sa account after resetting if you don’t need it, and use Windows Authentication or dedicated SQL logins instead.
If you have multiple SQL Server instances, repeat the process for each instance separately.
Test the new password immediately after restarting the service to ensure it works.

Troubleshooting

Cannot connect in single-user mode. If you get an error like “Another user has started a session”, it means something else is connected. Wait a few seconds and try again. If it persists, check for SQL Server Agent jobs or replication agents that might be running. You can also use the sqlcmd command line to connect: open an elevated command prompt and run sqlcmd -S localhost -E. If that works, run ALTER LOGIN sa WITH PASSWORD = 'NewPassword'; directly.

Service does not start with -m. Make sure you added the parameter correctly. In Configuration Manager, the parameter must be exactly -m (lowercase). Also, ensure that no other instance is using the same port or that the service account has proper permissions.

sa login still fails after reset. Check if the login is disabled. In SSMS, right-click sa → Properties → Status tab, and ensure Login is set to Enabled. Also verify that SQL Server is configured for mixed mode authentication: right-click the server in SSMS → Properties → Security → select SQL Server and Windows Authentication mode. You may need to restart the service after changing this.

Forgot the new password again? You can repeat the entire process. It’s a good idea to write the password down or use a password manager.

Frequently Asked Questions

Q: Can I reset the sa password without stopping the service? No, you must start in single-user mode, which requires stopping the service first.

Q: What if I don’t have Windows admin rights? You cannot perform this procedure without local administrator privileges on the server. Contact your IT department.

Q: Will this work on SQL Server Express? Yes, the steps are the same. The service name will be something like SQL Server (SQLEXPRESS).

Q: Is single-user mode safe for production? It’s safe if you follow the steps quickly and no other connections are active. However, it’s best to perform this during a maintenance window.

Q: Can I use PowerShell instead of SSMS? Yes, you can use sqlcmd or PowerShell with the SQL Server module. The key is to connect while in single-user mode.

Q: What if the sa account is locked out? The reset process also unlocks the account because you are changing the password. After reset, it will be enabled.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →