SQL Server SA password

[DianeLeigh]

I know they encrypt it, and I believe one-way... however, ... is there anyway to break it, to recover it?  I was hoping with time over the years, there may have been something that changed.

 

I know how to reset it with the -m startup parameter, add user as admin, then reset thing (from online instructions, etc)...

 

The catch is, we don't know if there's some program that is using the sa login (the SQL server is used mainly by a third party program, as in 95% by this program, maybe 100% by it--but it's stopped backing up, not a big deal as it's a VM and the VM is backed up, BUT, we'd like to know why, problem is, the third party who installed the server can't login as sa because their sa password they have doesn't work [all variants of what they had listed as the password], and all variants we have as what it was don't work).  

 

They, nor we, don't know if there's some unknown process or software using the sa login to do something using the sa login, so we can't change the password without potentially breaking a system critical software.  And yes, we could change it, then restore from the backup--but this server just happens to have hundreds/thousands of records entered per day, and indexed, making tens-thousands of records entered daily.  It would be a cluster if we did that (so to speak)--as records are entered 7 days a week and it'd be hours of work lost.  So.. I was hoping for some way to crack the password, not just reset it, so there wouldn't be any downtime, but we could just figure out why it wasn't backing up anymore.

 

But again, it's not even a bit deal really... just a curiosity.

 

 

[BloodKnight7]

you can recover sa, no problem, here is a tutorial I prefere the second method (Command line) https://www.wikihow.com/Reset-SA-Password-in-Sql-Server

 

[_crazy_crazy_]

i think the question is recover the password not replace .... https://blog.netspi.com/decrypting-mssql-credential-passwords/

[DianeLeigh]

Thanks

[Xplo1t]

I would suggest turning on logging for logins, both successful and unsuccessful and see if over a period of time sa is used. I know that doesn't directly give you an answer to your original question, but should give a good indication of which logins are being used.