SQL Server engine errors
Login Failed
Reviewed for reference consistency: August 11, 2026
the user login attempt failed
What 18456 Means
The 18456 error on the SQL Server engine errors indicates login failed — the user login attempt failed. This typically occurs due to the password is incorrect or has expired; the error log records state 8 for a wrong password.
Error 18456 is an authentication failure: SQL Server refused the login attempt itself, so the connection ended before any database was opened. The official message, 'Login failed for user ...', names the account and nothing else, because the text returned to the client deliberately hides the nature of the authentication error to increase security. The real reason is written to the SQL Server error log as a State number: 2 or 5 for an invalid user ID, 8 for an incorrect password, 7 for a disabled login, 58 for SQL authentication against a Windows-only server.
How to fix 18456
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Read the State code in the error log
The client message hides the reason, but the log entry carries a State number that maps to one condition: 5 an invalid user ID, 7 a disabled login, 38 a database that couldn't be found.
EXEC xp_readerrorlog 0, 1, N'Login failed';Confirm the login exists and is enabled
Check that the SQL login is present and not disabled before assuming the password is wrong.
SELECT name, is_disabled FROM sys.sql_logins WHERE name = 'youruser';Verify the server allows SQL logins
SQL authentication fails entirely when the instance runs in Windows-only mode. A result of 0 means mixed mode is enabled.
SELECT SERVERPROPERTY('IsIntegratedSecurityOnly');Reset the password if it is wrong or expired
Set a fresh strong password for the login, then update the application connection string to match.
High-impact command - back up first and proceed carefully.
ALTER LOGIN [youruser] WITH PASSWORD = 'NewStrongP@ssw0rd';
Technical Background
The official message text is 'Login failed for user '%.*ls'.%.*ls', raised under the symbolic name LOGON_FAILED at severity 14. It fires when a connection attempt is rejected because of an authentication failure, and invalid credentials, password expiration, and the wrong authentication mode are among the documented reasons logins fail.
The vagueness is a security property, not a missing detail: the message returned to the client deliberately hides the nature of the authentication error. The SQL Server error log records the same event with a State number that maps to one specific condition; an entry reading 'Error: 18456, Severity: 14, State: 8' identifies an incorrect password.
States worth knowing: 2 and 5 report an invalid user ID; 7 a disabled login, the state the sa login shows after a server switches from Windows-only to mixed mode; 8 an incorrect password; 11 and 12 a valid login whose server access failed; 38 and 46 a database the user requested that couldn't be found; 58 SQL authentication against a Windows-only server.
Authentication and authorization are different stages. 18456 sits at the authentication stage, and 4060 at the point where the accepted login opens the database the connection named. State 38 shows where they meet: a default database that no longer exists surfaces as a failed login rather than a named-database error.
Common Causes
- The password is incorrect or has expired; the error log records State 8 for a wrong password
- The login does not exist on this instance: States 2 and 5 report an invalid user ID
- The client attempts SQL Server Authentication while the instance is configured for Windows Authentication mode only (State 58)
- The login is disabled; State 7 pairs a disabled login with a wrong password, and the sa login starts disabled after an authentication-mode change
- The login's configured default database no longer exists, which the log shows as State 38, 'couldn't find database requested by user'
Typical Scenarios
- An application service account has an expired or rotated password, and every new connection is refused at authentication
- A developer connects with SQL Authentication while the server allows Windows Authentication only, and no credential change helps
- An environment was rebuilt or restored from another instance and the login was never recreated, so the user ID is rejected as invalid
- An administrator disabled the login, and even the correct password now fails
What to Know
Work from the error log, not the client message: the State number next to each event 18456 names the specific condition. Confirm the login exists and is enabled, verify that the instance allows the authentication mode the client is using, and only then reset credentials. For the default-database case, point the login's default at an available database or name a valid one in the connection string.
Frequently Asked Questions
Common questions about SQL Server 18456 error
That is deliberate. The message returned to the client hides the nature of the authentication error to increase security. The precise condition is recorded only in the SQL Server error log, where each failed login carries a State number that maps to one specific cause.
Read the log entries for event 18456: each carries Severity 14 and a State number. States 2 and 5 mean the user ID isn't valid, 8 means the password is incorrect, 7 means the login is disabled, 58 means SQL authentication was attempted while the server allows Windows authentication only, and 38 means the requested database couldn't be found.
18456 reports that the login attempt itself failed, and the message never names a database. 4060 is the message that names the database the server could not open, and it arrives after the credentials were accepted. The two meet at the default database: when the login's default database cannot be found, the 18456 log entry shows State 38, 'couldn't find database requested by user'.
No. The same message covers a disabled login, a wrong authentication mode, an expired password, and a missing default database. Treating it as a wrong password wastes the one reliable clue the error gives: the State number in the server's error log.
Related Errors From Other Categories
Similar error codes documented across different platforms and systems