SQL Server Error 18456 Login Failed for User: State Codes and Fixes
Fix error 18456 by reading the state number in the SQL Server error log. Microsoft hides the real reason from the client on purpose, and the state tells you if the problem is the login, the password, the authentication mode or the database. Match your state below and follow the steps for it.
By Neeraj Singh ~6 min Updated Nov 2026 Checked against Microsoft Learn
Error message
Login failed for user '<username>'. (Microsoft SQL Server, Error: 18456)
Summary
Error 18456 means SQL Server rejected your login. Your screen hides the reason. Open the SQL Server error log and read the state number next to the error. State 8 means a wrong password. States 2 and 5 mean the user ID is not valid. State 58 points to Windows Authentication only mode. States 38 and 46 mean the database is not found. State 1 means you lack permission to see the details. Ask your SQL Server administrator for the log. Fix the login, password, authentication mode or database that your state names, then connect again.
What SQL Server Error 18456 Means
Error 18456 is the Login failed for user message. SQL Server raises it when a connection attempt fails authentication. Microsoft lists invalid credentials, an expired password and a mismatched authentication mode among the causes.
Microsoft says the client message deliberately hides the nature of the failure to protect security. The SQL Server error log holds a matching entry with an error state. That the state maps to the real condition.
The user name in the message also helps. A name like NT AUTHORITY\ANONYMOUS LOGON or an empty name points to Kerberos, delegation or domain controller trouble instead of a plain wrong password.
Why SQL Server Rejects Your Login
The authentication mode is Windows Authentication only and you log in with a SQL Server login.
The login does not exist or you misspelled the name.
The password is wrong, expired or must be changed.
The login is disabled or locked out.
The login has no mapped database user or its default database is offline or missing.
The connection string points to the wrong server or still holds a DEV or QA setting.
✓ How to fix it
Method 1
Find the State in the SQL Server Error Log
1Connect to the instance in SQL Server Management Studio (SSMS) with an account that still works. Press F8 to open Object Explorer if it is closed.
2Expand Management, right-click SQL Server Logs, select View and then SQL Server Log. Microsoft lists these steps on its view the SQL Server error log page.
3Search the log for 18456 and read the State value in the Login failed entry.
4You can also read the log with a query. Microsoft says the first value is the log file number and 0 means the current log. The second value 1 selects the SQL Server log. The third value filters lines by a word.
5No access to the log? State 1 also means Microsoft hides the details from you. Ask your SQL Server administrator to read the state for you.
Method 2
Match Your State to the Right Fix
1Microsoft documents these states on its error 18456 page. Find your number and jump to the method.
2State 1. Error information is not available, because you lack permission to receive the details. Contact your SQL Server administrator.
3States 2 and 5. The user ID is not valid. Check the login name in Method 4.
4State 6. Someone used a Windows login name with SQL Server Authentication. Switch the connection to Windows Authentication or use a real SQL login.
5State 7. The login is disabled and the password is incorrect. State 8. The password is incorrect. State 9. The password is not valid. State 18. The password must be changed. Use Method 4 for all four.
6States 11 and 12. The login is valid but server access failed. For state 11, Microsoft says a Windows user in the local administrators group can fail when Windows does not pass administrator credentials. Start your program with the Run as administrator option and add that Windows user to SQL Server as its own login.
7State 38 and 46. SQL Server could not find the database the user requested. State 126. The requested database does not exist. Use Method 5.
8State 58. SQL Server uses Windows Authentication only and a client tried SQL authentication. Microsoft names mismatched SIDs as another cause. Use Method 3.
9State 62. A Windows account tried to reach a contained database and the SIDs do not match. States 102 to 111 and 132 to 133. Microsoft lists these as Azure AD failures. States 122 to 124. The user name or password was empty.
10Any other state points to an internal processing error, according to Microsoft.
Method 3
Change the Server Authentication Mode
1In SSMS, right-click the server in Object Explorer and select Properties.
2Open the Security page. Under Server authentication, select SQL Server and Windows Authentication mode and select OK.
3Select OK on the message that tells you SQL Server needs a restart.
4Right-click the server again and select Restart. Restart SQL Server Agent too if it is active. Microsoft documents these steps on its change server authentication mode page.
5Using sa? Microsoft says sa stays disabled when you switch the mode later. You must enable it and set a new password. Microsoft also warns that sa is a well known target. Enable it only if your application needs it and use a strong password.
USE [master];
GO
ALTER LOGIN sa ENABLE;
GO
ALTER LOGIN sa WITH PASSWORD = '<password>';
GO
6The other fix is to change your application to Windows Authentication. Use INTEGRATED SECURITY=SSPI in an OLE DB string or TRUSTED_CONNECTION=YES in an ODBC string.
Method 4
Check That the Login Exists, Is Enabled and Has the Right Password
1In SSMS, expand Security, then Logins. Look for the exact name from the error message. Create it if it is missing, because Microsoft lists a missing or misspelled login as a cause.
2To create one, right-click Security, point to New and select Login. Enter the Login name, choose Windows authentication or SQL Server authentication and select OK. The steps sit on the create a login page.
3Right-click an existing login, select Properties and open the Status page. Microsoft says Permission to connect to database engine must be set to Grant. A disabled login cannot authenticate. Make sure the Login option is enabled.
4Microsoft says a locked out login shows on the Status page for SQL logins. Clear the lockout with ALTER LOGIN and its reset option.
5Reset the password for a SQL login in the General page or with ALTER LOGIN. If User must change password at next login is selected, the old password triggers state 18 until you set a new one.
6If the login works but the database refuses it, create a mapped user inside that database.
CREATE USER [<UserName>] FOR LOGIN [<UserName>]
Method 5
Fix the Default Database and the Connection String
1Check the Default database on the General page of the login properties. Microsoft says an offline or unavailable default database also causes error 18456. The log then shows a line that begins with Failed to open the database.
2Ask an administrator to change the default database with the ALTER LOGIN statement or SSMS. The default value for a new login is master.
3Or name a database that works in your connection string. Microsoft lists this as a second fix.
4Compare the server name in your connection string with the server you want. Microsoft says a DEV or QA string can reach production by mistake.
5For Windows logins, check that you log in to the right domain. For an administrator account in SSMS, start the program with the Run as administrator option.
6Still failing with an empty name or NT AUTHORITY\ANONYMOUS LOGON? Microsoft ties those to domain controller, SPN and Kerberos problems. Its page lists the checks.
Error 18456 hides its cause from the client. Read the state in the SQL Server error log, match it to the login, password, authentication mode or database, fix that item and connect again.
Frequently asked questions
What does SQL Server error 18456 mean?
Error 18456 means SQL Server rejected a connection attempt because authentication failed. Microsoft lists invalid credentials, an expired password and a mismatched authentication mode as causes. The error log holds the state that names the exact reason.
Where do I find the state for error 18456?
Open SSMS, expand Management, right-click SQL Server Logs and select View, then SQL Server Log. Search for 18456 and read the State value. You can also use sp_readerrorlog with a filter.
What does state 1 mean in error 18456?
State 1 means error information is not available. Microsoft says it means you lack permission to receive the details. Ask your SQL Server administrator to read the log for you.
What does error 18456 state 8 mean?
State 8 means the password is incorrect. Reset the password for the SQL login or type the right one in your connection string.
What does error 18456 state 58 mean?
State 58 means SQL Server uses Windows Authentication only and a client tried SQL authentication. Microsoft names mismatched SIDs as another cause. Change the server to SQL Server and Windows Authentication mode or use Windows Authentication in your app.
What do states 38 and 46 mean?
Both states mean SQL Server could not find the database the user requested. Change the default database for the login or name an available database in the connection string.
Why does my sa login fail after I switch to mixed mode?
Microsoft says sa stays disabled when you change the mode after installation. Enable the login and set a new password, then restart SQL Server. Connect to sa with SQL Server Authentication only.
Do I need to restart SQL Server after I change the authentication mode?
Yes. Microsoft says SQL Server must restart for the change to take effect. Right-click the server in Object Explorer and select Restart.
Still not working?
If error 18456 stays after the fixes, SQL Server Errors lists more database engine problems you can check next. A damaged database file shows up as a different message. See the MDF file guide for the file side. None of these steps match your log? Submit your error with the state number and we will look into it.
