SQL Server 2019 on Windows 2022 — Support & Quick Start

Known issue on the current image (as of 2026-09-16)

No working SQL Server login exists on a freshly deployed VM: the only sysadmin is `sa`, and `sa` is disabled. Your portal-set Windows administrator has no SQL login at all (Windows-authentication-only mode), because Microsoft's post-deployment ConfigureImage hook fails on this image (it already ran once at build time and removed its own rights). The 2026-09-16 fact-check read this defect from a running VM built from our SQL Server 2019 on Windows Server 2022 build image. This offer's live plan publishes a legacy gallery image (version 1.0.0) that was not itself booted — the same SQL Server install recipe produced it, so assume the same defect until we publish a tested build. (image build tested: 1.0.0 — the version the Marketplace publishes today; the 2026-09-16 fact-check booted a DIFFERENT image (our build gallery's sql2019-ws2022-standard 2026.05.200), so the published image was not itself booted)

What you will see: SQL Server Management Studio / `sqlcmd` on the VM: `Login failed for user '<VM>\<admin>'` (error 18456); `sa` cannot be enabled because nobody can connect; C:\Program Files\Microsoft SQL Server\150\Setup Bootstrap\Log\Summary.txt shows ConfigureImage exit 0x84BB0001.

Workaround:

1. Rescue via single-user mode, from an elevated PowerShell as the Windows administrator you set at deploy (members of the local Administrators group can connect as sysadmin while the engine runs in single-user mode). Proven as SYSTEM on the SQL Server 2025 image (phase-2 fact-check, tests A/B); the same defect state was read from this image on 2026-09-16. The path as the portal admin was not separately exercised — email support if it fails.
2. 1. `net stop MSSQLSERVER` 2. `net start MSSQLSERVER /m"DCA-Rescue"` (single-user, restricted to one application name) 3. run the PowerShell below (built-in SqlClient — no SSMS or sqlcmd needed) 4. `net stop MSSQLSERVER` then `net start MSSQLSERVER` to return to normal mode.
3. Then connect with SSMS/sqlcmd using Windows authentication as that administrator. Port 1433 has NO Windows Firewall rule on this image — add one (and an NSG rule) for your app subnet only before remote clients can connect.

net stop MSSQLSERVER
net start MSSQLSERVER /m"DCA-Rescue"
$login = "$env:COMPUTERNAME\$env:USERNAME"
$c = New-Object System.Data.SqlClient.SqlConnection "Server=.;Integrated Security=SSPI;Application Name=DCA-Rescue"
$c.Open(); $q = $c.CreateCommand()
$q.CommandText = "IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$login') CREATE LOGIN [$login] FROM WINDOWS; ALTER SERVER ROLE [sysadmin] ADD MEMBER [$login];"
$q.ExecuteNonQuery(); $c.Close()
net stop MSSQLSERVER
net start MSSQLSERVER

Fix status: Fix in progress: image-factory PR #205 (draft, not yet built) — the change is on the template shared by every SQL Server on Windows profile: it removes the failing hook, grants your deployment administrator sysadmin at first boot and proves the login before the VM reports ready. Tracked as backlog #78. ⚠ This offer does NOT publish an image built by our image factory: its live plan(s) resolve to a legacy Shared Image Gallery in a different subscription, so image-factory PR #205 will not change what you deploy until the plan is repointed at a rebuilt image. Track the fix.

Source: our 2026-09-16 image sweep of the newest published build. This notice is removed when a build that passes the same test is live on the Marketplace.