Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here's the timeline of events:

  1. I attempted to log in to the database on my local machine using Microsoft SQL Server 2005. I was informed that my sa user was locked out with the below error message. Off to google.

    Error Number: 18486 Severity: 14 State: 1 Line Number: 65536

  2. I logged into the the server using the administrator account, logged into MS SQL Server using Windows authentication and unlocked the sa user. At this point the 4 websites using this account went down and my inbox started flooding.

  3. I attempted to log in using the sa account again, first on my local machine then on the server, and got an error that said something about a connection was made, but there was nothing on the other end of the pipe (I don't remember the exact wording, but I have the error code from my google history, below). The internet tells me that this is because I need to enable mixed-method authentication (Windows/SQL). Which was already enabled, but I checked it anyway. Yep, still enabled.

    Error Number: 233 Severity: 20 State: 0

  4. I check the properties on the sa user again. Locked out. I unlock again, and just in case reset the password. Nothing doing.
  5. I restart the server, because I can't think of what else to try. Still nothing.
  6. In a why-the-heck not moment, I switch the authentication to Windows only, back to mixed, and restart again. Still nothing.
  7. I create a new user profile on the server and give it sysadmin privileges. Works like a charm. Change all the connection string in the 4 web pages, and all is good.
No matter what I do, the original sa user remains locked. Still is, as a matter of fact. Any ideas what might be causing this?

share|improve this question
Exactly why are you running web sites under an account with sa privileges, let alone running four web different sites under the same user account? You're doing it wrong. –  Skyhawk Nov 2 '12 at 18:25
@MilesErickson be that as it may, it's not my system. I inherited all of it from someone who inherited it from someone else, and I'm just a grunt (I've worked here about a month). If you saw the tables I have to deal with, it'd give you a headache, I know it gave me one. –  mikeTheLiar Nov 2 '12 at 18:47

1 Answer 1

Would have wanted to comment but not enough reputation.

It actually sounds as though you may be the victim of a brute force attack

you can try to disable the policy on your system or on your domain level.

N.B. this will affect your security protection level.

Your step 7. is actually a Best practice and is recommended instead of using the SA account.

share|improve this answer
FWIW I wasn't using the default sa account, I referred to it as shorthand for the account with the sysadmin privileges. –  mikeTheLiar Nov 2 '12 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.