How to Reset the SQL Server sa Password (Windows and Linux)

Applies to: SQL Server 2017 to 2025 on Windows (steps from Microsoft’s documentation) and SQL Server on Linux (tested with SQL Server 2022 CU27 on Linux)

There is no default sa password. You choose it when SQL Server is installed in mixed mode, and if nobody knows it, you reset it. How you do that depends on whether you can still log in with another administrator account.

First, read the real reason

The client only says Login failed for user 'sa'. (error 18456). SQL Server’s error log gives the reason. These are lines from our test server:

Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: 172.17.0.3]
Login failed for user 'sa'. Reason: The account is disabled. [CLIENT: 172.17.0.3]

• Password did not match: reset the password with one of the methods below.
• The account is disabled: enable it with ALTER LOGIN sa ENABLE;. According to Microsoft, sa starts out disabled when a server installed with Windows Authentication only is later switched to mixed mode.
• Server is configured for Windows authentication only: sa can’t log in at all. In SQL Server Management Studio, open the server’s Properties, go to Security, choose SQL Server and Windows Authentication mode and restart SQL Server.

On Linux the log is /var/opt/mssql/log/errorlog. It is stored as UTF-16, so a plain grep may find nothing. Read it with sudo cat, or convert it first with sudo iconv -f UTF-16LE -t UTF-8 /var/opt/mssql/log/errorlog | grep "Login failed".

Method 1: you can still log in as another administrator

If any login is a member of the sysadmin role (a Windows account or another SQL login), use it to reset sa:

ALTER LOGIN sa WITH PASSWORD = 'N3w-Str0ng-Passw0rd!';
ALTER LOGIN sa ENABLE;

In our test we disabled sa, reset it this way from a second sysadmin login (dbadmin), and sa could log in again straight away, without a restart. The password must meet the policy; a short one is refused:

Msg 33062, Level 16, State 2, Server 683824aff845, Line 1
Password validation failed. The password does not meet SQL Server password policy requirements because it is too short. The password must be at least 8 characters.

By default, Microsoft requires at least 8 characters from three of these four groups: upper case, lower case, digits and symbols.

Method 2 (Windows): single-user mode

If no administrator login works, Microsoft’s procedure is to start SQL Server in single-user mode. In that mode, any member of the Windows local Administrators group can connect as sysadmin.

1. Log in to Windows as a local administrator and open PowerShell or Command Prompt with Run as administrator.
2. Stop SQL Server Agent if it runs. Otherwise it may take the only connection.
3. Restart SQL Server in single-user mode, accepting connections from sqlcmd only (write SQLCMD in capitals):

   net stop MSSQLSERVER
   net start MSSQLSERVER /f /mSQLCMD

   For a named instance, the service is called MSSQL$INSTANCENAME.
4. Reset the password with Windows authentication (-E):

   sqlcmd -S . -E -Q "ALTER LOGIN sa WITH PASSWORD = 'N3w-Str0ng-Passw0rd!'; ALTER LOGIN sa ENABLE;"

   For a named instance use -S .\INSTANCENAME. If you get Reason: Server is in single user mode. Only one administrator can connect at this time., another program took the connection; close it and try again.
5. Restart normally, then start SQL Server Agent again:

   net stop MSSQLSERVER
   net start MSSQLSERVER

Better still, also add your own Windows account to sysadmin in step 4 (CREATE LOGIN [SERVER\you] FROM WINDOWS; ALTER SERVER ROLE sysadmin ADD MEMBER [SERVER\you];) so you are never locked out again.

Method 3 (Linux): mssql-conf

sudo systemctl stop mssql-server
sudo /opt/mssql/bin/mssql-conf set-sa-password
sudo systemctl start mssql-server

It asks for the new password (we supplied it in the MSSQL_SA_PASSWORD environment variable) and prints:

Configuring SQL Server...
The system administrator password has been changed.
Please run 'sudo systemctl start mssql-server' to start SQL Server.

After the start, the old password was refused and the new one worked. When you test with sqlcmd on the Linux command line, escape a $ in the password as \$ (or use single quotes), or the shell changes it before SQL Server sees it.

After the reset

• Use named logins for people and applications, and keep sa for emergencies, or disable it with ALTER LOGIN sa DISABLE;.
• Don’t leave port 1433 open to the whole internet. Allow it only from the IP addresses that need it: open ports on Windows Server.
• If SQL Server won’t start after changing startup options, see SQL Server service is not starting. To manage logins with a graphical tool, see install SQL Server Management Studio.

Official documentation: Microsoft: connect to SQL Server when system administrators are locked out and Microsoft: troubleshoot SQL Server on Linux.