SQL Server 2019 on Windows Server — Support & Quick Start

Known issue on the current image (as of 2026-10-14)

No working SQL Server login exists on a freshly deployed VM: the only sysadmin is `sa`, and `sa` is disabled. Your portal-set Windows administrator has no SQL login at all (Windows-authentication-only mode), because Microsoft's post-deployment ConfigureImage hook fails on this image (it already ran once at build time and removed its own rights). This applies to VMs deployed from the "SQL Server 2019 Web on Windows Server 2019 (Gen2, retired plan)" plan and from the two hidden "(Gen2, 2024 image)" plans, which still publish the 2024 image 2.2.2. The seven current plans (Enterprise, Standard, Web and Database Engine only, on Windows Server 2019 and 2022) publish a fixed image and are not affected. (image build tested: 2.2.2 — the only version on the "SQL Server 2019 Web on Windows Server 2019 (Gen2, retired plan)" plan and on the two hidden "(Gen2, 2024 image)" plans (live tree, read 2026-10-14); the seven current plans publish the fixed 2026.1012.0020 (see the fixed note below). The 2024 image was not itself booted: the 2026-09-16 fact-check read the defect from our SQL Server 2019 on Windows Server 2019 build image, produced by the same recipe)

What you will see: SQL Server Management Studio / `sqlcmd` on the VM: `Login failed for user '<VM>\<admin>'` (error 18456); `sa` cannot be enabled because nobody can connect; C:\Program Files\Microsoft SQL Server\150\Setup Bootstrap\Log\Summary.txt shows ConfigureImage exit 0x84BB0001.

Workaround:

1. Rescue via single-user mode, from an elevated PowerShell as the Windows administrator you set at deploy (members of the local Administrators group can connect as sysadmin while the engine runs in single-user mode). Proven as SYSTEM on the SQL Server 2025 image (phase-2 fact-check, tests A/B); the same defect state was read from this image on 2026-09-16. The path as the portal admin was not separately exercised — email support if it fails.
2. 1. `net stop MSSQLSERVER` 2. `net start MSSQLSERVER /m"DCA-Rescue"` (single-user, restricted to one application name) 3. run the PowerShell below (built-in SqlClient — no SSMS or sqlcmd needed) 4. `net stop MSSQLSERVER` then `net start MSSQLSERVER` to return to normal mode.
3. Then connect with SSMS/sqlcmd using Windows authentication as that administrator. Port 1433 has NO Windows Firewall rule on this image — add one (and an NSG rule) for your app subnet only before remote clients can connect.
4. For a new deployment, choose one of the seven current plans; their image 2026.1012.0020 grants your administrator sysadmin at first boot.

net stop MSSQLSERVER
net start MSSQLSERVER /m"DCA-Rescue"
$login = "$env:COMPUTERNAME\$env:USERNAME"
$c = New-Object System.Data.SqlClient.SqlConnection "Server=.;Integrated Security=SSPI;Application Name=DCA-Rescue"
$c.Open(); $q = $c.CreateCommand()
$q.CommandText = "IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$login') CREATE LOGIN [$login] FROM WINDOWS; ALTER SERVER ROLE [sysadmin] ADD MEMBER [$login];"
$q.ExecuteNonQuery(); $c.Close()
net stop MSSQLSERVER
net start MSSQLSERVER

Fix status: Fixed at source in image-factory PR #205 (merged 2026-09-17) and live on this offer's seven current plans as 2026.1012.0020 since 2026-10-13 (see the fixed note). The retired Web plan and the two hidden 2024-image plans still resolve to the legacy gallery image 2.2.2, which was not rebuilt: a VM deployed from them today is the one described above. Track the fix.

Source: our 2026-10-14 image sweep of the newest published build. This notice is removed when a build that passes the same test is live on the Marketplace.