Loath though I am to defend M$... (Score 1)

This is not their issue. This is about companies rushing to the web without people qualified to perform the work. If you are going to use a relational database as part of your application, you need a DBA. Period. A DBA is not someone who was in the same room once when Access was installed. SQL Server has always had this. Any DBA worth the title knows to set the sa password as soon as the server is installed. This is not unique to MS SQL Server. Sybase (from whence MS SQL Server came) has the same exact issue. Oracle also has default passwords set for the SYS and SYSTEM accounts. It is common practice. These accounts must be active and used during the installation process. It is nothing new and certainly not news. If you have your NT admin or an application developer install and configure a production database server you deserve what you get. If someone calling him/her self a DBA does this they deserve to be tarred and feathered - certainly stripped of the title. MS's only complicity here is that they do foster the mistaken belief that anyone can install and administer SS7 - that there is less need for a qualified and experienced DBA.