How to fix Error 5604 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 5604 is actually an informational/benign message that appears in the SQL Server Error Log, typically triggered during setup or an unattended installation when SQL Server detects Mixed Mode Authentication is enabled but no explicit, complex password was supplied for the sa account. Because the Setup wizard or command-line installer requires a strong password to satisfy Windows Server 2025 security policies, the engine automatically regenerates a random, complex password for the sa login to prevent the installation from failing outright. While the message confirms the regeneration succeeded, it effectively locks the sa account behind an unknown password string, which can block administrators expecting to log in with a default or specific credential.

Step-by-Step Resolution Guide

Step 1: Verify the Current Authentication Mode

  • Open SQL Server Management Studio (SSMS) and connect using Windows Authentication (since you don’t know the auto-generated sa password).
  • Right-click the server instance in Object Explorer, select Properties, then navigate to the Security page to confirm “SQL Server and Windows Authentication mode” is selected.

Step 2: Manually Reset the SA Password via T-SQL

  • In a New Query window (connected via Windows Auth), run the following to overwrite the randomly generated password:
  • ALTER LOGIN sa WITH PASSWORD = 'YourNew$trongP@ssw0rd123';
  • Ensure the new password meets Windows Server 2025 complexity policies (minimum 8 characters, uppercase, lowercase, numbers, and symbols) to avoid triggering the regeneration event again on restart.

Step 3: Enable and Unlock the SA Login

  • Confirm the login is not disabled by running:
  • ALTER LOGIN sa ENABLE;
  • Check the login properties in SSMS under Security > Logins > sa > Status to ensure “Login” is set to Enabled and “Permission to connect to database engine” is set to Grant.

Step 4: Restart the SQL Server Service

  • Open Services.msc on Windows Server 2025 or Windows 11.
  • Locate SQL Server (MSSQLSERVER) or the named instance, right-click, and select Restart to ensure the Authentication Mode and password changes are fully applied to the engine.

Alternative or Verification Steps

  • Verification: Attempt to log in via SSMS using SQL Server Authentication with the username sa and the new password you set in Step 2. A successful connection confirms the fix.
  • Alternative: If the sa login remains inaccessible, start the SQL Server instance in Single-User Mode (using the -m startup parameter via SQL Server Configuration Manager) to reset the password without interference from other active sessions.