# Extract MSSQL Link Password
Step 1: Get Local Instances
Step 2 : Get the current User
Step 3: Get the version
Step 4: Check if you can impersonate sa
Step 5: Enable DAC
Step 6: Check if port 1434 is enabled
Step 7: If you dont see 1434 enabled see below
Step 8: Check if you have **-T7806 in SQL Args. If you dont see below**
Step 9 : Add SQLArg3 as -T7806
```
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL15.SQLEXPRESS\MSSQLServer\Parameters\" -Name "SQLArg3" -Value "-T7806" -PropertyType "String"
```
Step 10: Check if you have SQLBrowser running
```
Get-Service | Where {$_.Name -Like "*SQLBROWSER*"}
```
Step 11: Check if you have named pipes enabled
```
Set-ItemProperty "HKLM:\Software\Microsoft\Microsoft SQL Server\MSSQL15.SQLEXPRESS\MSSQLServer\SuperSocketNetLib\Np\" -Name Enabled -Value 1 -Type DWord
```
Step 12: Restart the services
Step 13: Check if UDP port 1434 is now enabled
Extract the Link Password
Reference:
{% embed url="" %}
{% embed url="" %}
Create SA account
{% embed url="" %}
{% embed url="" %}