SQL SERVER – Creating System Admin (SA) Login With Empty Password – Bad Practice

An empty password on sa is a serious security failure. I stopped an e-commerce consultation after noticing passwordless administrator sign-ins.

I don’t request customer credentials. We could resume after they secured the account with a secret unknown to me. Their investigation found an accidental password change. The historical dangerous statement appears only as a disabled example.

SELECT name, is_disabled, is_policy_checked, is_expiration_checked
FROM sys.sql_logins WHERE sid = 0x01;
-- Historical incident only, DO NOT EXECUTE:
-- ALTER LOGIN [sa] WITH PASSWORD = N'';

The query identifies the built-in principal by SID, even after renaming. It reports disabled and policy flags without exposing a password. It does not prove whether the password is empty. Permissions and policy also affect password-change behavior.

I prefer named identities with least privilege. Assess dependencies before disabling an unused sa account. Manage any required secret through the organization’s process. Don’t publish it in a script or share it with a consultant.

Correct exposed credentials and affected dependencies before routine troubleshooting resumes. Verify the intended access afterward. Keep credential handling with the authorized customer team.

Related reading

• Comprehensive Database Performance Health Check
• earlier consulting blog post
• SQL SERVER – DISABLE and ENABLE user SA
• Can Admin Rename SA Account in SQL Server? – Interview Question of the Week #256
• How to Change Owner of Database in SQL SERVER? – Interview Question of the Week #117

A policy flag is not evidence of a strong password, it is one account setting within credential management.

Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.