How to enable an SA account that has been disabled

In Microsoft SQL Server, the “SA” login is a highly privileged account. This is often referred to as the “system administrator” or “superuser” login. In this article, we shall show you how to enable an SA account that has been disabled. Please see How to manage automatic login on Ubuntu Linux, how to fix Unable to connect to MSSQL Server after changing the Server name, and how to enable or disable automatic login on macOS: Fix username greyed out for automatic login.

Why would an SA Account Be Disabled?

More generally, an Administrator can disable an SA (System Administrator) account that has already been active for security purposes. If there are concerns about the integrity of the account. Such as a potential compromise or unauthorized access. The account may be disabled to prevent further security risks.

Also, the “SA” login account is disabled out of the box (by default) in Windows Authentication mode. You have to enable it manually to use it. If this is the case for you, this guide will show you the steps to enable or disable as you wish.

Note: If you select Mixed Mode Authentication during MSSQL Server installation, SQL Server Setup prompts you to set an SA login password. The SA login account is enabled in this case.

Lastly, If you see a red “X” symbol next to the SA (System Administrator) login in Microsoft SQL Server. It shows that the SA account is disabled or locked out. Follow the steps to troubleshoot and resolve this issue.

Also, see How to reset MSSQL Server SA Password on Ubuntu, how to Install Microsoft SQL Server 2019 and MSSQL Command line tools on Ubuntu Linux, and How to access shared resources from two different domains

Steps to Enable an SA Account

To enable a disabled SA account, an authorized administrator with the necessary permissions would have to perform this task using an alternative credential (administrative privileges) with the right permissions in place.

They can then access the user account management settings and re-enable the account. This process often involves navigating through security policies or user management tools.

To do this, open SQL Server Management Studio. From the Object Explorer, navigate to the “Security” folder in the Object Explorer, and then “Logins”.

Right-click on the SA login, and select “Properties”.

This will open the Login Properties sheet. In the “General” tab, ensure that the “Login” is enabled as shown below.

If none of the above steps resolves the issue and you’re still unable to access the database using the SA account, it’s possible that there are more complex issues at play. In such cases, you may need to involve a database administrator or a system administrator to further diagnose and resolve the problem.

Also, do not forget to check the SQL Server logs for any error messages or information about login failures. This can provide additional insight into the issue.

Can I Still Retrieve Data from a Disabled SA Account?

Disabling an SA account usually pertains to account authentication rather than data accessibility. If the account has been disabled for security reasons. Retrieving data may still be possible through alternative means, such as accessing backups or using other authorized accounts with appropriate permissions.

What Are the Implications of a Disabled SA Account?

When an SA account is disabled. Services, applications, or systems that rely on that account for authentication or authorization may experience disruptions. It’s crucial to understand the dependencies and potential impact on system functionality before disabling an SA account.

How would you enable or disable System Administrator (SA) login in MSSQL?

– To enable sa login using T-SQL script: ALTER LOGIN sa ENABLE ; GO ALTER LOGIN sa WITH PASSWORD = 'xxasyouwish34w@'; GO
– To disable sa login using T-SQL script: ALTER LOGIN sa DISABLE ; GO

Microsoft does not recommend using SA login in the application (as it is often targeted by malicious users. Also note that the sa login cannot be removed/deleted

Conclusion

Renaming and disabling the SA account will not stop internal processes from being able to use the SA account. Therefore, if you have databases whose owners are SA, there isn’t a problem. This is a good thing, because some databases, like master and tempdb, require the SA account as the owner. Also, having SQL Server Agent jobs owned by SA will not fail either. Therefore, there’s no reason NOT to rename and disable the SA account.

I hope you found this blog post on how to enable an SA account that has been disabled helpful. Please let me know in the comment section if you have any questions.