Based on feedback in the comments on this answer, the situation is this:
There is an explicitly-created
BUILTIN\Administrators group login in SQL Server that has been denied
CONNECT to the database engine.
There is no other
sysadmin-level login available, including the
NT AUTHORITY\SYSTEM login that gets created by default.
SQL Server does not allow a user to disable the
BUILTIN\Administrators login, but it can still be denied
CONNECT. I consider this a bug, as it's obvious that the inability to disable the login outright was hard-coded into the engine to avoid scenarios like this.
I'm unable to get in after applying that permission.
You will have to either find a way to edit the contents of the
master database to get rid of the
DENY permission (totally unsupported, and at your own peril), reinstall the database engine from the installation media, or I suppose you could attempt to brute-force the
I don't believe you can simply rebuild
master as that requires connecting and authenticating against the database engine, which isn't available here.
Okay, I can repro this. I was wrong in the comments. In fact, I just locked myself out of a local instance!
There is a
SERVER\Administrator login in SQL Server that's explicitly disabled.
If there is a
NT AUTHORITY\SYSTEM (local system) login in SQL Server, you can use one of the methods described on my blog here to get in without needing to down the service.
If there is no login for that account, here's what you need to do:
- Create a new local administrator user account
- Restart the database engine service in single-user mode using
- Impersonate the account created in step 1 to start either
sqlcmd or Management Studio
- Fix things up as appropriate
- Restart the database engine service in multi-user mode (remove
- Delete the local admin account created in step 1