SQL Server Error 18488

Error number

18488

Severity

14 (user-correctable error)

State

1

Product

Microsoft SQL Server Database Engine

Versions

All supported SQL Server versions (2016 to 2025), Azure SQL Managed Instance

Category

Logins & Permissions

Last reviewed

24 October 2026

What it means

Error 18488 means the SQL login is flagged MUST_CHANGE: the password is correct, but SQL Server will not open a session until the login sets a new password.

When a SQL login is created or reset WITH PASSWORD = ... MUST_CHANGE, SQL Server marks it so that the first login must choose a new password. A client that can change the password during login handles this (we tested sqlcmd -z, which sends the new password with the login). A client that cannot, such as an application with a fixed connection string, simply fails with 18488 at severity 14.

The reason is shown only after the password has been checked, so the message also tells you that the password itself was right. MUST_CHANGE only exists together with CHECK_POLICY = ON and CHECK_EXPIRATION = ON; in our test, trying to turn expiration off while the flag was still set failed with error 15128.

Common causes

• An administrator created the login, or reset its password, with MUST_CHANGE (in SQL Server Management Studio: the "User must change password at next login" box on the login page).
• A login meant for an application was created with MUST_CHANGE, and the application cannot change passwords.
• A password reset procedure for people was applied to a service login.

Diagnose it

Read-only These queries only read metadata and dynamic management views. They do not change data, permissions or configuration, so they are safe to run first.

SELECT name, is_policy_checked, is_expiration_checked,
       LOGINPROPERTY(name, 'IsMustChange')        AS must_change,
       LOGINPROPERTY(name, 'PasswordLastSetTime') AS password_last_set
FROM sys.sql_logins
WHERE name = N'app_login';

EXEC sp_readerrorlog 0, 1, N'must be changed';

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

-- From a command prompt (sqlcmd prompts for the current password when -P is omitted):
-- sqlcmd -S SQL01 -U app_login -z "New-strong-password-1" -Q "SELECT 1"

ALTER LOGIN [app_login] WITH PASSWORD = N'Use-a-strong-unique-password-1';

Examples

First login of an account created WITH MUST_CHANGE

Reproduced with a temporary SQL login and the correct password. The client output and the matching error log lines follow.

CREATE LOGIN [app_login]
    WITH PASSWORD = N'Use-a-strong-unique-password-1' MUST_CHANGE,
         CHECK_POLICY = ON, CHECK_EXPIRATION = ON;

-- From a command prompt, with that password:
-- sqlcmd -S . -C -U app_login -Q "SELECT 1"

-- Then, as an administrator, read the error log:
EXEC sp_readerrorlog 0, 1, N'app_login';

Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Login failed for user 'app_login'.  Reason: The password of the account must be changed..

Error log:
Error: 18488, Severity: 14, State: 1.
Login failed for user 'app_login'.  Reason: The password of the account must be changed. [CLIENT: <local machine>]

How to prevent it

Use MUST_CHANGE for logins that people use interactively, and never for application logins. Create application logins with a strong password stored in a secrets manager, and keep CHECK_POLICY = ON.

When you hand a new login to a person, tell them they will be asked for a new password and which tool to use. Related login failures: error 18456 (wrong password, unknown login) and error 18470 (disabled login).

Common questions

Learn more on CodeWithSQL

• SQL Server security: logins, users and permissions

Official documentation

• ALTER LOGIN (Transact-SQL)
• Password policy (Microsoft Learn)
• Database engine events and errors 18000 to 18999 (Microsoft Learn)

Last technically reviewed 24 October 2026; examples and diagnostics run on SQL Server 2025 (17.0.1145.4). Message text checked against the engine's sys.messages catalogue.