Backdoor in SQL server. Is this hacking, loop hole or Feature ?

DBAs should always be ready to face any kind of disaster in SQL environment. That doesn't matter whether it is PROD or Non- PROD. 

Recently I have been asked regarding recovering the sysadmin password. I couldn't understand the question hence investigated more to understand actual problem. Then I came to know that there is one SQL Server for which admin login and password is lost. I was Like seriously ? How one can be that much of irresponsible? But rather than getting into that kind of discussion I quickly got ready to help the team. 

In SQL Server there is a way to access SQL Instance without login. Lets check that out.

Steps :

1) Open SQL Server Configuration  Manager.

2) Right click on SQL Server service and go to Properties.

3) Go to "Startup Parameters" Tab and Add -m. This will Start the server in Single user mode. 

4) Click Apply and Ok. This change would require Service restart. 

5) Once Service is restarted then, open CMD as Administrator. 

6) Now to connect to instance, type "SQLCMD -S <Instance Name>" (Without Quotes)

Note : 

If you get next line as 1> means SQL instance is connected.

To verify the connection, type simple queries. 

Ex : Select @@Servername

7) Now we can create SQL login and add the same in sysadmin role.

SQL :

C:\Windows\system32>sqlcmd -s VMDHRDB01

1> CREATE LOGIN Superman WITH PASSWORD = 'SaveWorld#2021';

2> go

1> EXEC sp_addsrvrolemember 'Superman', 'sysadmin';

2> go

1>

8) Once login is Created then revert the change made in Step 2. i.e. Remove -m from Startup parameters and restart the SQL Service. 

now we can connect to SQL Server using newly created SQL Admin Login. 

Above Technique will be helpful in situation like,

1) Lost SA Password

2) Someone Intentionally Deleted Admin Logins or Changed Admin Credentials.

3) Administrating unknows SQL environment where admin login and password is unknown. 

Etc.

One can get into the discussion like this is kind of hacking, Data theft or Loop hole in SQL server and start getting others panic. also, this is something which can not be avoided. 

We should look at this as a feature of SQL server which is very much helpful in common scenarios listed above. 

IMP To remember :

Since server is in single user mode, only one connection can be allowed at a time.

If you get below error while login, then, there must be exiting connection in SQL server.