Just to clarify: When you change to mixed-mode authentication from Integrated Security the 'sa' account is by default disabled. If it is enabled then it is because a SYSADMIN has enabled it.....