SQL Server 2025 on Windows Server 2025 — Support & Quick Start

Known issue on the current image (as of 2026-09-15)

No working SQL Server login exists on a freshly deployed VM: the only sysadmin is `sa`, and `sa` is disabled. Your portal-set Windows administrator has no SQL login at all (Windows-authentication-only mode), because Microsoft's post-deployment ConfigureImage hook fails on this image (it already ran once at build time and removed its own rights). (image build tested: 2026.06.17 — also the version the Marketplace publishes today (all three live plans resolve to gallery version 2026.06.17, confirmed against Partner Center 2026-09-17))

What you will see: SQL Server Management Studio / `sqlcmd` on the VM: `Login failed for user '<VM>\<admin>'` (error 18456); `sa` cannot be enabled because nobody can connect; Setup Bootstrap logs show ConfigureImage exit 0x84BB0001.

Workaround:

1. Rescue via single-user mode, from an elevated PowerShell as the Windows administrator you set at deploy (members of the local Administrators group can connect as sysadmin while the engine runs in single-user mode). This is the same repair our fix performs; it was proven as SYSTEM on the shipped image (phase-2 fact-check, tests A/B) — the path as the portal admin was not separately exercised.
2. 1. `net stop MSSQLSERVER` 2. `net start MSSQLSERVER /m"DCA-Rescue"` (single-user, restricted to one application name) 3. run the PowerShell below (it uses the built-in SqlClient — no SSMS or sqlcmd needed) 4. `net stop MSSQLSERVER` then `net start MSSQLSERVER` to return to normal mode.
3. Then connect with SSMS/sqlcmd using Windows authentication as that administrator. Port 1433 also has NO Windows Firewall rule on this image — add one (and an NSG rule) to your app subnet only before remote clients can connect.

net stop MSSQLSERVER
net start MSSQLSERVER /m"DCA-Rescue"
$login = "$env:COMPUTERNAME\$env:USERNAME"
$c = New-Object System.Data.SqlClient.SqlConnection "Server=.;Integrated Security=SSPI;Application Name=DCA-Rescue"
$c.Open(); $q = $c.CreateCommand()
$q.CommandText = "IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$login') CREATE LOGIN [$login] FROM WINDOWS; ALTER SERVER ROLE [sysadmin] ADD MEMBER [$login];"
$q.ExecuteNonQuery(); $c.Close()
net stop MSSQLSERVER
net start MSSQLSERVER

Fix status: Fix in progress: image-factory PR #205 (draft, not yet built) — removes the failing hook, grants your deployment administrator sysadmin at first boot and proves the login before the VM reports ready. Tracked as backlog #78. Track the fix.

Source: our 2026-09-15 image sweep of the newest published build. This notice is removed when a build that passes the same test is live on the Marketplace.