I need to know in which file SQL Server 2008 actually stores the passwords. This is a question being asked by a security auditor.

I know I can get password hashes with LOGINPROPERTY('bbellomo', 'PasswordHash'), but that doesn't help me; I need to know how they are stored.


The passwords aren't stored in plaintext. If the auditor really needs the file in which they're stored, point them at the master.mdf file. This is, of course, for SQL logins. For Windows logins, SQL doesn't even know what the password is; Active Directory handles the authentication.

| improve this answer | |

Try to look into sys.server_principals user names and passwords are in the master database. But the passwords are not stored in plaintext.

| improve this answer | |
  • Give him SELECT * FROM SYSLOGINS if he/she really needs output – jl. Jul 20 '11 at 16:02

The execution plan from 'SELECT password FROM syslogins' shows the passwords are stored in sys.sysxlgns in the master database.

Take a look at: System Base Tables

Here are the passwords, in the only 2 formats SQL Server will show them to us:

SELECT name, password, LOGINPROPERTY(name, 'PasswordHash' ) hash
FROM syslogins

You can probably convert between the formats easily, but I don’t know how off hand.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.