Password Recovery

[ecobb]

Is there any way for SQL Server (2000) to show what the password for a login is? I have a program that accesses the database, and I need to know what the existing password for that account is. If I change the password, that will mean having to reset the connections on approx. 100 computers. Please help!

Thanks

 

[SemperFiDownUnda]

You have 100 computers connecting to a database and don't know what password they all use? No I believe SQL server uses a 1 way hash password system in which you can't get that information.

Looks like to me you need to update your policy and proceedures so this password isn't lost.

Please don't tell me you have all the computers logging in as SA!?!?! If not, have you lost that password too?

 

[ecobb]

This database was set up for one of our clients over 3 years ago. They have a main program that all of their employees access via Citrix. The program accesses the database through a single ODBC connection that was hard coded into the program by the software vendor (over 3 years ago). None of us that are involved in this situation were around when everything was set up.

And no, I have not lost the SA password, thank you very much. As stupid as it was for the software vendor to have the connection hard coded into their program, only a damn fool would hardcode an SA account into it. My policies and procedures are much different than those here before me, who thought that 'sa' and 'blank' were the only connections anyone needed.

 

[SemperFiDownUnda]

I'm wondering why you need the password though. As is there another way to achieve what you need. You need the current applications to continue running and they are hard coded so you can't change the server name user and password. If you need new applications to access the database then you can create a new user.

About the only way you are going to get the password is a brute force attack. Seeing they where lax the password is probably something easy and a dictionary attack might reveal it. Though I'm not sure you might be able to sniff the password off the network also. Depends on where the hashing is done.