Service pack installation may save the system administrator password in a file

If you use SQL Server Authentication, also known as Standard Security, to install the products listed in the "Applies to" section, the system administrator (sa) password may be stored in clear text, or in an encrypted readable format in the SQL Server Setup files.

Also, if you configure SQL Server Services by using a domain account, the domain account password may be written to the Setup.iss file in a weakly encrypted format.

Note Microsoft SQL Server 2000 Service Pack 3 (SP3) or later versions use encryption on the included passwords in these files. This encryption helps improve security. However, we still recommend that you remove the encrypted passwords or the installation files that contain the passwords if they are no longer required.

SQL Server 7.0

The sa password or the domain account password is saved in a clear text or a weakly encrypted format in the Setup.iss file in the %Windir% folder.

NoteThe %Windir% folder will also vary if the original installation was completed through a Terminal Server connection. A copy of this file is created in the %SystemDrive%\MSSQL7\Install\or\Tools folder when the Setup program finishes.

The password information may also be included in the Sqlstp.log file and in the Sqlsp*.log file. These files exist in the %Windir% folder and the Temp folder. The %Windir% folder will also vary if the original installation was completed through a Terminal Server connection. On Microsoft Windows 2000-based computers, the Temp folder is set under the Environment Variables on the Advanced tab of the System Control Panel.

SQL Server 2000

The sa password or the domain account password is saved in an encrypted, but readable format in the Sqlstp.log, Sqlsp.log and the Setup.iss files in the Drive:\Program Files\Microsoft SQL Server\Mssql\Install folder for a default installation. Note that the Mssql folder may be MSSQL$InstanceName for a named instance installation. The Setup.iss file for SQL Server 2000 uses Access Control List. Therefore, only Windows NT administrators and SQL Server administrators can access the file.

SQL Server 2000 also includes the ability to natively install on a Windows Clustered server. The remote cluster Setup log files are Remsetup.ini and a remote install script file that is similar to the Setup.iss files for each remote node. These remote install script files are named RemoteComputerName_InstanceName.iss. These files are also stored in the %Windir% folder and are ordinarily deleted when the Setup program finishes. However, these files may potentially be left behind if the cluster setup experiences a failure.

To resolve this problem, use one of the following methods:

• Use Microsoft Windows NT Security Authentication to install the original release version of SQL Server or a service pack. Then, use the LocalSystem account when you configure the SQL Services. This method avoids this problem.
• Change the SQL Server sysadmin (sa) password and the SQL Service domain account password after you install the service pack.
• After you install the products that are listed in the "Applies to" section, you must run the Killpwd.exe utility to clean the setup files. The Killpwd.exe utility works for SQL Server 7.0 and for SQL Server 2000.
  
  Note Previously, Microsoft released an update for SQL Server 7.0 (MSDE 1.0) Service Pack 2 and for SQL Server 7.0 Service Pack 3. However, you do not have to use the updates because the updated Killpwd.exe utility supersedes the previous updates.

Killpwd utility instructions

Microsoft has created a command utility, Killpwd.exe, to search the Microsoft SQL Server Setup files for the sa login password. If the Killpwd.exe utility finds an occurrence of the sa password, the sa password is removed from the log file in basic mode operation. By default, the tool searches the Sqlsp.log, Sqlstp.log, and Setup.iss files in the %Windir%\Temp and %Temp% folders, where %Windir% and %Temp% are environment variables defined by Microsoft Windows.

Microsoft has updated the Killpwd.exe utility to include more locations where the setup files that remote and cluster installations create are located. In some scenarios, these files may have names or paths that vary from the defaults. These variants are the following:

• Clustered installations will create setup files on all nodes. If you want to run the utility from a single node, you must also specify the UNC paths to the drives on remote nodes if you want to remove those files. Alternatively, you can run the utility from each node to clean up the setup files that exist locally.
• Remote files that are created for cluster setup follow the following format:
  RemoteComputerName_InstanceName.iss
  If the computer name has been modified or if an instance has been removed, the utility will not know to search for files under these file names by default.
• If the name of the Windows cluster has been changed, the log files have the old file names. In this scenario, the utility would not know to search for files under these file names by default.
• Terminal Server connections use different %Temp% and %WinDir% folders. These folders may vary with user id and environment variables.
• Remote setup may use the local %Temp% location instead of storing files on the computer on which the installation of SQL Server is occurring. The Killpwd utility cannot determine whether this is the case and cannot know which remote path to search for the log files.

Download and then run the latest Killpwd.exe utility from the link in this article. The new version includes the ability to specify locations other than the default location to find all possible versions of these files. You can also specify remote locations.

For more information about these log files and unattended installations, see your SQL Server documentation. If you create an *.iss file to perform unattended installations, you must copy the *.iss file to a security-enhanced location that is not in searchable folders.

Note These setup information files are also left behind when you remove SQL Server. This behavior is by design. This behavior lets you troubleshoot why an installation might have failed if you are forced to rollback and lets you use an ISS file to reinstall this instance or other instances. In this case, this instance of SQL Server is clearly no longer available to take advantage of. However, the nature of passwords is so that you might have used the same password for another instance of SQL Server that has not yet been removed.

To run the Killpwd.exe utility use one of the following methods:

• Double-click Killpwd.exe.
• Run Killpwd.exe at a command prompt.
  
  When you run Killpwd.exe at a command prompt, you receive more information.
  
  Note At a command prompt, you can use the following parameters:
  
  Help information
  Killpwd.exe /?
  To specify a non-default search path and file
  Killpwd.exe PathFileName

Note For SQL Server 2000, you must specify the location of the Setup.iss file if you want to remove occurrences of the sa password. The Setup.iss file for SQL Server 2000 is located in the Drive:\Program Files\Microsoft SQL Server\Mssql\Install folder for a default installation. Note that the Mssql folder may be MSSQL$InstanceName. If you will use the Setup.iss file later to perform an unattended installation of SQL Server, do not run Killpwd.exe on the Setup.iss file.

You may receive the following messages:

Steps to run the Killpwd.exe utility

To run the Killpwd.exe utility, follow these steps:

1. Download and extract Killpwd.exe.
   
   The following file is available for download from the Microsoft Download Center:
   
   
   Collapse this imageExpand this image

   
   Download the Killpwd.exe package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=7BDA4AE4-E287-4A6B-86E4-9AFDB3EA26C9&displaylang=en) Release Date: June 14, 2005
   
   For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
   119591  (http://support.microsoft.com/kb/119591/ ) How to obtain Microsoft support files from online services
   Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
2. Run the self-extracting executable file to extract the package. During the extraction process, you are prompted to specify a destination folder for Killpwd.exe.
3. In Windows Explorer, move to the folder you specify in step 2. Double-click Killpwd.exe to run the program. Or open a command prompt, and then enter the path of Killpwd.exe to run the executable.

Command-line parameters

The following command-line parameters are available in the new version of Killpwd.exe:
Note You must have Windows Administrator rights to run the utility.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about how to download and to install the latest SQL Server service pack, click the following article numbers to view the articles in the Microsoft Knowledge Base: For more information, contact your primary support provider.

The Sqlsp.log file is used to track the installation progress and to troubleshoot service pack installation failures.

For more information about how to determine which folder Windows is installed in, click the following article number to view the article in the Microsoft Knowledge Base:

For more information, see the following Microsoft Security Bulletins: If you did not see an answer to your question, visit the Microsoft SQL Server Newsgroups at: Do you have comments about this article or other Microsoft SQL Server Knowledge Base articles? Send us a note at: