The sa account is SQL Server’s built-in administrator login. It is enabled when an instance uses mixed-mode authentication, has full administrative permissions, and requires a password during installation. Windows authentication avoids SQL logins, but mixed mode is often needed by applications. section 14.2
Leaving sa enabled is a common security mistake. Its name is well known, so an attacker can target an administrative login directly and try password dictionaries in a brute-force attack. Treat it as an avoidable, highly privileged attack target rather than a routine application or administrator account. section 14.2 section 14.8
For a mixed-mode instance, reduce exposure deliberately:
- Disable sa when other security principals, ideally Windows users or groups, can administer the instance. section 14.2
- Otherwise rename sa and enforce password policy and expiration. section 14.2
- Ensure administrators have only the permissions required for their normal duties; elevate and revoke access for exceptional work. section 14.8
Disable the built-in login
Run this command after confirming that another administrator can access the instance: ALTER LOGIN sa DISABLE; This removes the well-known login from use without relying on its password strength. section 14.2 section 14.8
Listing 14.4 Renaming the sa account
ALTER LOGIN sa WITH NAME = InstanceAdmin ;
Use the rename statement when sa cannot be disabled; it changes the predictable administrator login name. section 14.2
