How to fix Error 5603 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 5603 – SA Password Could Not Be Force Regenerated (-K Startup Option)

Why This Error Happens

This error occurs when SQL Server’s -K startup option attempts to regenerate the SA account password but fails due to insufficient privileges on the service account, a locked or corrupted master database, or a conflict in the Windows Registry permissions tied to SQL Server’s installation path. It can also happen if the SQL Server service account lacks the necessary rights to write to the system catalog during startup, or if the master database files are in a read-only state. Additionally, Group Policy restrictions on Windows Server 2025 / Windows 11 may block the forced credential rewrite operation.

Step-by-Step Resolution Guide

Step 1: Verify Service Account Permissions

  • Open Services.msc and locate the SQL Server (MSSQLSERVER) service.
  • Right-click → Properties → Log On tab, and confirm the account has “Log on as a service” rights.
  • Ensure the account has full control over C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\DATA.
  • Run icacls "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\DATA" /grant "NT SERVICE\MSSQLSERVER":(OI)(CI)F in an elevated Command Prompt.

Step 2: Check and Repair Master Database File Permissions

  • Navigate to the DATA folder and confirm master.mdf and mastlog.ldf are not set to read-only.
  • Right-click each file → Properties → uncheck “Read-only” if selected.
  • Run sqlservr.exe -c -m -T3608 from an elevated command prompt to start SQL Server in single-user, minimal configuration mode for manual diagnostics.

Step 3: Remove and Reapply the -K Startup Parameter Correctly

  • Open SQL Server Configuration Manager → SQL Server Services → right-click instance → Properties → Startup Parameters tab.
  • Remove the existing -K parameter entirely and restart the service once to confirm normal startup.
  • Re-add -K only when prepared to immediately supply a new SA password via -K"NewStrongPassword!123" and restart the service again.

Step 4: Validate Group Policy and Registry Access

  • Open gpedit.msc and confirm no local security policies restrict password changes for system accounts.
  • Check registry path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQLServer for correct permission inheritance.
  • Restart the SQL Server service as Administrator after confirming registry ACLs are intact.

Alternative or Verification Steps

  • After restarting, check the SQL Server Error Log (ERRORLOG file in the DATA folder) to confirm the SA password reset completed without Error 5603 reappearing.
  • If the issue persists, use sqlcmd -S localhost -U sa -P "NewStrongPassword!123" to manually test SA login, or fallback to rebuilding system databases via setup.exe /ACTION=REBUILDDATABASE if corruption is suspected.