Configure MSSQL Mix Mode Authentication

Some times we installed the wrong authentication mode for Microsoft SQL Server 2000
and 2005.
It would be quite troublesom to configure web application connection string or way to
connect the
windows authentication database server.

Hope the solution as below help!

You can re configure SQL Server with windows authentication mode to mixed mode
authentication.

For MSSQL Server 2000

======================
1. Launch Enterprise Manage for SQL Server 2000.
2. Right click current active database server (Usually named local) 's "PROPERTY".
3. Click on the "SECURITY" tab, and change:
Authentication
- Tick "SQL SERVER AND WINDOWS radio button

Audit Level
- Tick "None"

Ownership Chaining
- Uncheck

4. Startup service account

- Tick "System account"

5. Restart server

For SQL 2005 Express Edition

============================
No GUI tool available to configure the server it to MIX MODE!
You need to go it manually. The first step is to change the login-mode.

1. Press Window Key + R ( Run ) and key in regedit to launch Registery Editor.

2. Go to HKLM\Software\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer in the

tree on the left.

3. On the right, look for an entry named LoginMode.

The default value would be 1.

Now change it to 2 ( HEX )

4. Restart the SQL Service.

Type services.msc in the RUN to launch your Service Manager (Start -> Run -> Type
services.msc)
and look for a service named MSSQL Server (SQLEXPRESS).
Right Click and Restart the service.

In this stage, if you already have an exisiting SA user, make sure you enable the SA
user.

Configure a valid SA User properties:

1. Open SQL Management Studio

2. Connect via windows authentication ( use windows authentication to change the SA

user property to be valid )

3. Under current SQL Server > Security > Logins > Double Click on SA user.
a. Change the password
b. Uncheck "Enforce password policy" if not needed
c. Default database set to "master"
d. Default language set to "english"

4. Property of Server Roles, Check on "public" and "sysadmin"

5. Property of User Mapping, Map databases with User (dbo) and Default Schema (dbo)
value.

6. Property of Status,
a. Permission to connect to databse engine, set to "Grant"
b. Login, set to "Enabled"

or you can use command prompt way:

To add a user with administrative priviledges so that the database can be accessed
from ASP.Net.

On the command prompt, login to SQL Server command prompt using the osql utility.
SQL Server 2005 Express Edition is installed with the instance name SQLEXPRESS.

Use the following command to login:

=============================
osql -E -S .\SQLEXPRESS
=============================

One the SQL-command prompt, execute the following?

1> exec sp_addlogin 'username', 'password'

2> go
1> exec sp_addsrvroleadmin 'username', 'sysadmin'
2> go
1> quit

Replace the username and password but not forget the quotes. To verify, try login
using the following on the command prompt:
=================================
osql -S .\SQLExpress -U username
=================================
Provide the password when asked.
SUMMARY
This step-by-step article discusses the steps you can use to change the SQL
Server sa (system administrator) password.

You can configure Microsoft SQL Server 2005 Express, Microsoft SQL Server Desktop
Engine (MSDE) versions 2000, or earlier versions of Microsoft SQL Server to run in
Mixed Authentication mode. The sa account is created during the installation process
and the sa account has full rights in the SQL Server environment. By default,
the sa password is blank (NULL), unless you change the password when you run the
MSDE Setup program. To conform with the best security practices, you must change
the sa password to a strong password at the first opportunity.

Back to the top

How to verify if the SA password is blank

1. On the computer that is hosting the instance of MSDE to which you are connecting, open a command prompt window.

At the command prompt, type the following command, and then press ENTER:
2.
osql -U sa

This connects you to the local, default instance of MSDE by using the sa account. To connect to a named instance installed on
your computer type:

osql -U sa -S servername\instancename

You are now at the following prompt:

Password:

3. Press ENTER again. This will pass a NULL (blank) password for sa.

If you are now at the following prompt, after you press ENTER, then you do not have a password for thesa account:

1>

We recommend that you create a non-NULL, strong password to conform with security practices.

However, if you receive the following error message, you have entered an incorrect password. This error message indicates that a
password has been created for the sa account:

"Login Failed for user 'sa'."

The following error message indicates that the computer that is running SQL Server is set to Windows Authentication only:

Login failed for user 'sa'. Reason: Not associated with a trusted SQL Server connection.

You cannot verify your sa password while in Windows Authentication mode. However, you can create asa password so that
your sa account is secure in case your authentication mode is changed to Mixed Mode in the future.
 If you receive the following error message, SQL Server may not be running or you may have provided an incorrect name for the
named instance of SQL Server that is installed:

[Shared Memory]SQL Server does not exist or access denied.

[Shared Memory]ConnectionOpen (Connect()).

Back to the top

How to change your SA password

1. On the computer that is hosting the instance of MSDE to which you are connecting, open the command prompt window.

Type the following command, and then press ENTER:

2.
osql -U sa

At the Password: prompt, press ENTER if your password is blank or type the current password. This connects you to the local,
default instance of MSDE by using the sa account. To connect by using Windows authentication, type this command: use osql -E

Note If you are using SQL Server 2005 Express, avoid using the Osql utility, and plan to modify applications that currently use the
Osql feature. Use the Sqlcmd utility instead.

For more information about the Sqlcmd utility, visit the following Microsoft Developer Network (MSDN) Web site:
http://msdn2.microsoft.com/en-us/library/ms165702.aspx

3. Type the following commands, on separate lines, and then press ENTER:

sp_password @old = null, @new = 'complexpwd', @loginame ='sa'

go
Note Make sure that you replace "complexpwd" with the new strong password. A strong password includes alpha-numeric and
special characters, and a combination of upper and lower case characters.

You will receive the following informational message, which indicates that your password was changed successfully:

Password changed.

Back to the top

How to determine or change your authentication mode

Important This section, method, or task contains steps that tell you how to modify the
registry. However, serious problems might occur if you modify the registry incorrectly.
Therefore, make sure that you follow these steps carefully. For added protection, back
up the registry before you modify it. Then, you can restore the registry if a problem
occurs. For more information about how to back up and restore the registry, click the
following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

If you are not sure how to verify the authentication mode of your MSDE installation,
you can check the corresponding registry entry. By default, the value of the
Windows LoginMode registry subkey is set to 1 for Windows Authentication. When
Mixed Mode authentication is enabled, this value is a 2.

• The location of the LoginMode subkey depends on whether you installed MSDE as the default MSDE instance or as a named
instance. If you installed MSDE as the default instance, the LoginMode subkey is located in the following registry subkey:

HKLM\Software\Microsoft\MSSqlserver\MSSqlServer\LoginMode

Note If you are using SQL Server 2005, whatever you installed a default instance or a named instance, locate the following
registry subkey. MSSQL.x is a placeholder for the corresponding value for your system:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.x\MSSQLServer

• If you installed MSDE as a named instance, the LoginMode subkey is located in the following registry subkey:

HKLM\Software\Microsoft\Microsoft SQL Server\%InstanceName%\MSSQLServer\LoginMode

Note Before you switch authentication modes, you must set a sa password to avoid
exposing a potential security hole.

To switch from Mixed Mode to Integrated (Windows) authentication, follow these steps:

1. To stop MSSQLSERVER and all other related services (such as SQLSERVERAgent), open the Servicesapplet in Control Panel.

Open the Registry Editor. To open the Registry Editor, click Start, click Run, and then type: "regedt32" (without the quotation
2. marks)

Click OK.

3. Locate either of the following subkeys (depending on whether you installed MSDE as the default MSDE instance or as a named
instance:

HKEY_LOCAL_MACHINE\Software\Microsoft\MSSqlserver\MSSqlServer

or

HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\<Instance Name>\MSSQLServer\

4. In the right-pane, double-click the LoginMode subkey.

5. In the DWORD Editor dialog box, set the value of this subkey to 1. Make sure that the Hex option is selected, and then click OK.

6. Restart the MSSQLSERVER and the SQLSERVERAgent services for this change to take effect.

Back to the top

Security best practices for a SQL Server installation
Each of the items that follow will make your system more secure and they are part of
the standard security "best practices" for any SQL Server installation.

• Secure your sa login account with a non-NULL password. There are worms that only work if you have no security for
your sa login account. Therefore, to make sure that the built-in sa account has a strong password, you must follow the
recommendation provided in the "System Administrator (SA) Login" topic in SQL Server Books Online, even if you never directly
use the sa account.

• Block port 1433 at your Internet gateways, and then assign SQL Server to listen on an alternate port.

• If port 1433 must be available on your Internet gateways, enable egress and ingress filtering to prevent misuse of the port.

• Run the SQLServer service and SQL Server Agent under a Microsoft Windows NT account, not a Local System account.

• Enable Microsoft Windows NT Authentication, and then enable auditing for successful and failed logins. Then, stop and restart
the MSSQLServer service. Configure your clients to use Windows NT Authentication.

Back to the top

REFERENCES
For more information regarding how a blank sa password can be exploited, click the
following article number to view the article in the Microsoft Knowledge Base:

313418 PRB: Unsecured SQL Server with blank (NULL) SA password leaves vulnerability
to a worm

For more information about a change in behavior with post-SQL Server 2000 Service
Pack 1 when the authentication mode changes, click the following article number to
view the article in the Microsoft Knowledge Base:

274773 FIX: If you change Windows Security to Windows/SQL Security, the SA

password is blank