How to Retrieve Lost SA Password in SQL Server

Losing the SQL Server system administrator (SA) password can lock you out of your databases, but the account can usually be recovered by restarting SQL Server in single-user mode and connecting as a local administrator. This guide walks you through that process, plus what to do if you can’t get in that way.

What You’ll Need

Windows administrative access to the machine running SQL Server (local admin rights or the ability to start/stop services).
SQL Server Management Studio (SSMS) or sqlcmd command-line tool installed.
Knowledge of the SQL Server instance name (e.g., MSSQLSERVER for default, or SQLEXPRESS for named instances).

Step-by-Step

Stop the SQL Server service. Open Services (Win+R, type services.msc). Find the service named SQL Server (MSSQLSERVER) or SQL Server (SQLEXPRESS). Right-click it and select Stop. If it won’t stop, open Command Prompt as Administrator and run net stop MSSQLSERVER (adjust the service name if needed).
Start SQL Server in single-user mode. Open Command Prompt as Administrator. Navigate to the SQL Server binary folder, typically C:\Program Files\Microsoft SQL Server\MSSQLxx.MSSQLSERVER\MSSQL\Binn (the exact path depends on your version). Run: sqlservr.exe -m and press Enter. This starts SQL Server in single-user mode, which allows only one connection—reserved for a sysadmin.
Connect using sqlcmd as a Windows admin. In a second Command Prompt window (still as Administrator), run: sqlcmd -S . -E. The -E flag uses Windows authentication. If you’re using a named instance, use sqlcmd -S .\SQLEXPRESS -E.
Reset the SA password. At the sqlcmd prompt, type the following and press Enter after each line:
```
ALTER LOGIN sa WITH PASSWORD = 'YourNewStrongPassword';
GO
```
Replace YourNewStrongPassword with a strong password. If you also want to enable the SA login (it’s often disabled), run: ALTER LOGIN sa ENABLE; followed by GO.
Exit sqlcmd and stop the single-user instance. Type QUIT and press Enter. Then go back to the first Command Prompt window and press Ctrl+C to stop the sqlservr process. Wait for it to shut down completely.
Restart SQL Server normally. In Services, right-click the SQL Server service and select Start. Alternatively, run net start MSSQLSERVER in an elevated Command Prompt.
Verify the new SA password. Open SSMS, choose SQL Server Authentication, enter sa and the new password. If you can connect, you’re done. If not, double-check that the SA login is enabled and that the server is configured for mixed mode authentication (see Troubleshooting).

Common Mistakes

Forgetting to start in single-user mode: If you try to connect with sqlcmd while SQL Server is running normally, you’ll get an error because only one connection is allowed in single-user mode—but if you’re not in single-user mode, you can’t reset the password at all.
Using the wrong service name: The service name isn’t always MSSQLSERVER. Check Services for the exact name, especially for named instances.
Not running as Administrator: sqlcmd with -E requires Windows admin rights. If you’re not elevated, you’ll get a login failed error.
Leaving single-user mode on: If you forget to stop sqlservr.exe, SQL Server will keep running in single-user mode and block other connections.
Typing the ALTER statement incorrectly: A missing semicolon or GO can cause a syntax error. Make sure each line is entered exactly as shown.

Tips

Always use a strong password for SA—at least 12 characters with a mix of upper/lowercase, numbers, and symbols.
Consider creating a Windows-authenticated login with sysadmin rights and leaving SA disabled. That way you have a fallback that doesn’t rely on a password you might lose.
Write down the SA password and store it in a secure password manager. Avoid keeping it in plain text files.
If you have other sysadmin logins, you can reset SA from them without restarting in single-user mode, but this method works when all sysadmin passwords are lost.
Test the new password immediately after restarting to confirm the change took effect.

Troubleshooting

sqlcmd says “Login failed for user” – This usually means you’re not connecting as a Windows admin. Ensure the Command Prompt is running as Administrator. Also verify that the instance name is correct (use sqlcmd -L to list instances).

SQL Server won’t start in single-user mode – Check the error log in the LOG folder under the instance directory. Common causes: another instance is already using the port, or you don’t have permission to the data files. Make sure you’re running sqlservr.exe from the correct Binn folder.

You can’t connect because SQL Server is in single-user mode but something else is connected – The single-user mode allows only one connection. If a background process (like a maintenance job) grabs it, you’ll be blocked. Restart the service and try again quickly, or stop other SQL-related services temporarily.

After resetting, SA still can’t log in – The SA login might be disabled. Run ALTER LOGIN sa ENABLE; and then check the server authentication mode. If it’s set to Windows-only, change it to Mixed Mode via SSMS (right-click server > Properties > Security) or run EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2; then restart.

You get an error about the password policy – SQL Server enforces Windows password policy. If your new password doesn’t meet complexity requirements, choose a stronger one.

Frequently Asked Questions

Can I recover the SA password without restarting SQL Server? – Only if you have another sysadmin login. If you’re completely locked out, the single-user mode method is the standard way.

Will this work on SQL Server Express? – Yes, the process is the same. Just use the correct service name (e.g., SQLEXPRESS) and adjust the path.

What if I don’t have Windows admin rights? – You’ll need to contact your system administrator. There’s no way to reset SA without administrative access to the server.

Is it safe to run sqlservr.exe -m? – Yes, but only do it when the server is not in production. Single-user mode blocks all other connections, so schedule this during maintenance windows.

Can I use this method to reset other SQL logins? – Yes, you can run ALTER LOGIN [username] WITH PASSWORD = '...' for any login, as long as you’re connected as a sysadmin.

Does this work on Azure SQL Database? – No. Azure SQL doesn’t allow single-user mode. For Azure, you’d need to reset the password via the Azure portal or by using the server admin account.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →