How to Change SQL Server System Administrator Accounts

Changing a SQL Server system admin requires stopping the service, restarting in single-user mode, and adding a new admin login through a command prompt — or using SQL Server Management Studio if you still have admin access

If you have forgotten the system administrator (sa) password, locked yourself out of SQL Server, or need to transfer admin duties to someone else, you have two paths forward. The faster route is SQL Server Management Studio if you can still log in as any admin. The recovery route is restarting SQL Server in single-user mode from the command line, which bypasses normal login checks and lets you add a new admin account directly.

Which path you take depends on whether you have any working admin login at all. If you do, use Management Studio. If you do not, use single-user mode recovery. Both take 10 to 20 minutes and require local access to the server — you cannot do this remotely.

Key Takeaways

If you have any working admin login, open SQL Server Management Studio, right-click the server name, choose Properties, go to Security, and change the sa password or add a new admin login without touching single-user mode.
If you have no working admin login, stop the SQL Server service, restart it with the -m flag from Command Prompt, connect as the system admin in single-user mode, then add a new login and grant it sysadmin role.
Single-user mode locks out all other connections, so stop any applications using SQL Server before you start the recovery process.
After you regain access, restart SQL Server normally and verify the new admin login works before you leave the server.

Changing the sa password if you have any admin access

Open SQL Server Management Studio on the server itself. In the Object Explorer pane on the left, right-click the server name at the top and select Properties. Click the Security page on the left side of the window.

Under Server Authentication, you will see two radio buttons: Windows Authentication Mode and SQL Server and Windows Authentication Mode. If SQL Server and Windows Authentication Mode is already selected, you can change the sa password. If only Windows Authentication Mode is selected, click the radio button to enable SQL Server authentication, then click OK and restart the SQL Server service.

Once SQL Server and Windows Authentication Mode is on, go back to Properties > Security. In the Object Explorer, expand Security > Logins, right-click sa, and select Properties. Click the General page, enter a new password in the Password field, confirm it, and click OK. The sa password is now changed.

Adding a new admin login if you have any admin access

If you want to add a second admin account instead of changing the sa password, open SQL Server Management Studio and expand Security > Logins in the Object Explorer. Right-click Logins and select New Login.

Enter a login name (for example, your Windows username or a new SQL Server login name). If you are using Windows Authentication, select Windows Authentication and enter the account name in the format DOMAIN\USERNAME. If you are using SQL Server Authentication, select SQL Server Authentication and enter a password.

Click the Server Roles page on the left. Check the box next to sysadmin. Click OK. The new login is now a system administrator and can log in with full permissions.

Recovering access using single-user mode

If you have no working admin login, you must restart SQL Server in single-user mode. First, stop the SQL Server service. On Windows, open Services (press Windows Key + R, type services.msc, and press Enter). Find SQL Server (MSSQLSERVER) or the named instance you use, right-click it, and select Stop. Wait for the status to show stopped.

Open Command Prompt as Administrator (right-click Command Prompt and select Run as Administrator). Navigate to the SQL Server binary folder. For SQL Server 2019 and 2022, this is usually C:\Program Files\Microsoft SQL Server\MSSQL15\MSSQL\Binn (the folder number changes by version). Type the command:

sqlservr.exe -m

The server will start in single-user mode. You will see messages in the Command Prompt window showing the startup process. When you see "SQL Server is now ready for client connections", the server is ready.

Adding a new admin in single-user mode

Open a second Command Prompt window (do not close the first one). In the new window, type:

sqlcmd -S .\MSSQLSERVER -E

Replace MSSQLSERVER with the name of your instance if you use a named instance. The -E flag uses Windows Authentication, which works in single-user mode even if you have no SQL Server login. You will see a numbered prompt (1>).

Type the following command to create a new admin login (replace NewAdminName and password with your own):

CREATE LOGIN [NewAdminName] WITH PASSWORD = 'YourNewPassword';

Press Enter. Type GO and press Enter to execute the command. Then type:

ALTER SERVER ROLE sysadmin ADD MEMBER [NewAdminName];

Press Enter, type GO, and press Enter again. The new login is now a system administrator. Type EXIT and press Enter to close sqlcmd.

Restarting SQL Server normally

In the first Command Prompt window (the one running sqlservr.exe), press Ctrl+C to stop the server. You will see a shutdown message. Wait for the Command Prompt to return to a normal prompt.

Open Services again (Windows Key + R, type services.msc, Enter). Find SQL Server (MSSQLSERVER), right-click it, and select Start. The service will restart in normal mode.

Open SQL Server Management Studio. In the Connect to Server dialog, enter the server name, select SQL Server Authentication, enter your new login name and password, and click Connect. If the connection succeeds, you have regained admin access and can manage the server normally.

Preventing lockout in the future

Create at least two admin accounts so that if you forget one password, you can use the other to reset it. Store the passwords in a password manager or a find location that someone else in your organization can access if you are unavailable.

If you use Windows Authentication, add your Windows user account as a sysadmin login. This way, you can always log in using your Windows credentials even if all SQL Server logins are compromised. In SQL Server Management Studio, right-click Logins, select New Login, choose Windows Authentication, enter your Windows username, click Server Roles, check sysadmin, and click OK.

Frequently Asked Questions

Can I change the sa password without restarting SQL Server?

Yes, if you have any working admin login. Open SQL Server Management Studio, expand Security > Logins, right-click sa, select Properties, enter a new password, and click OK. You do not need to restart the service.

What if I restart in single-user mode and cannot connect with sqlcmd?

Make sure you are using the -E flag (sqlcmd -S .\MSSQLSERVER -E) to connect with Windows Authentication. If the command still fails, check that the SQL Server binary folder path is correct for your version. You can also try sqlcmd -S localhost\MSSQLSERVER -E if the instance name does not work.

Will changing the sa password affect my applications?

Only if your applications use the sa login to connect to SQL Server. If they do, you must update the connection string in each process with the new password before restarting SQL Server in normal mode, or the applications will fail to connect.

Can I remove the sa account entirely?

You can disable it by right-clicking the sa login in SQL Server Management Studio, selecting Properties, and checking Disable Login. However, Microsoft recommends keeping it disabled rather than deleting it, because some SQL Server tools expect it to exist.

What if I have a named instance instead of the default MSSQLSERVER?

Replace MSSQLSERVER with your instance name in all commands. For example, if your instance is called SQLEXPRESS, use sqlcmd -S .\SQLEXPRESS -E and sqlservr.exe -m -s SQLEXPRESS in the Command Prompt.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.