Connection failures to Microsoft SQL Server on Windows Server 2019 typically stem from the database engine being stopped, TCP/IP protocol disabled in Configuration Manager, or Windows Firewall blocking port 1433. This article provides a systematic troubleshooting workflow to restore connectivity by verifying service status, enabling network protocols, and configuring firewall rules for inbound traffic.
Verify SQL Server Service Status
The most common reason for connection refusal is that the SQL Server instance has not started or crashed after installation. Before diving into complex network configurations, you must ensure the background process responsible for handling database requests is active. Open the Services management console by pressingWin + R, typing services.msc, and hitting Enter. Locate the service named MSSQLSERVER for the default instance, or MSSQL$INSTANCENAME for named instances.
Check the Status column. If it reads "Stopped," right-click the service and select Start. You should also verify the Startup Type is set to Automatic to ensure the database starts with the server boot. If the service fails to start, check the Event Viewer under Windows Logs > Application for error codes related to SQL Server. A failed start often indicates missing dependencies, corrupted data files, or insufficient permissions for the service account. In many cases, restarting the server resolves transient startup issues, but if the problem persists, review the SQL Server Error Log located in the %ProgramFiles%\Microsoft SQL Server\MSSQLxx.MSSQLSERVER\MSSQL\Log directory.
Enable Network Protocols
Even if the service is running, the server may refuse external connections because the necessary communication protocols are disabled. By default, some installations leave certain protocols turned off for security reasons. Open the SQL Server Configuration Manager. You can find this in the Start Menu under Microsoft SQL Server. Navigate to SQL Server Network Configuration and then Protocols for MSSQLSERVER. You will see a list of protocols such as Shared Memory, Named Pipes, and TCP/IP. For remote connections over the network, TCP/IP must be enabled. Right-click TCP/IP and select Properties. Go to the IP Addresses tab. Scroll down to the IPAll section at the bottom of the list. Ensure that the Tcp Port is set to 1433, which is the standard port for SQL Server. If you are using a named instance, it might use a dynamic port; however, setting a static port like 1433 simplifies firewall configuration. After making changes, you must restart the SQL Server service for the new settings to take effect. Return to the Services console and restart MSSQLSERVER.Configure Windows Firewall Rules
Windows Server 2019 includes a robust firewall that blocks incoming connections by default. Even with TCP/IP enabled, the OS will drop packets destined for port 1433 unless explicitly allowed. Open Windows Defender Firewall with Advanced Security from the Start Menu. Select Inbound Rules on the left pane. Look for a rule named SQL Server (MSSQLSERVER) or similar. If it exists, ensure it is enabled. If it does not exist, you must create a new rule. Click New Rule... on the right. Choose Port and click Next. Select TCP and enter 1433 in the specific local ports field. Click Next, choose Allow the connection, and apply it to Domain, Private, and Public profiles depending on your network environment. Name the rule clearly, such as "SQL Server Port 1433". This step is critical for any client machine attempting to connect to the database remotely. If you are testing locally, you might also need to allow connections through the loopback interface, but for server-to-server or client-to-server communication, this inbound rule is mandatory.Check SQL Server Authentication Mode
Another frequent cause of connection errors is an authentication mismatch. SQL Server supports two modes: Windows Authentication and Mixed Mode (SQL Server and Windows Authentication). If your application uses a SQL Login (username and password) rather than a Windows domain account, Mixed Mode must be enabled. Open SQL Server Management Studio (SSMS) and connect to the server using Windows Authentication. Right-click the server name in Object Explorer and select Properties. Go to the Security page. Under Server authentication, select SQL Server and Windows Authentication mode. Click OK. You will receive a warning that the change requires a service restart. Restart the SQL Server service again to apply this change. Additionally, ensure that the specific SQL Login account you are using is not disabled and has the correct password.Test Connectivity
Once these steps are completed, test the connection from a client machine. Usetelnet <ServerIP> 1433 to verify basic network reachability. If the connection opens, the network path is clear. Then, attempt to connect via SSMS or your application. If issues persist, consider checking DNS resolution to ensure the server name resolves correctly to the IP address. For more advanced networking scenarios involving NAT or complex routing, refer to our guide on Configuring Windows Server 2019 as a Domain Controller, File Server, and Simple NAT Router with DHCP, DNS, and VLAN Support.
Frequently Asked Questions
Why does my SQL Server instance show as 'Offline' in SSMS?
An offline status usually means the underlying service is stopped or the database files are detached. Check the Windows Services console to ensure the MSSQLSERVER service is running. If the service is up, verify that the database files (.mdf and .ldf) are accessible and not marked as read-only or locked by another process.
Can I use a different port than 1433?
Yes, you can configure SQL Server to listen on any available TCP port. However, you must update both the TCP/IP properties in SQL Server Configuration Manager and the corresponding Windows Firewall inbound rule to match the new port number. Clients must also specify the custom port when connecting.
What if I am using a Named Instance?
Named instances typically use dynamic ports assigned by the SQL Server Browser service. You must enable the SQL Server Browser service and ensure UDP port 1434 is open in the firewall. Alternatively, you can assign a static TCP port to the named instance in the IP Addresses tab of the TCP/IP properties for easier firewall management.
How do I reset a forgotten SA password?
If you have administrative access to the Windows Server, you can log into SSMS using Windows Authentication and run a T-SQL command to alter the login password. Connect to the server, open a new query window, and execute ALTER LOGIN [sa] WITH PASSWORD = 'NewPassword'; followed by GO.
Is it safe to disable the Windows Firewall entirely?
No, disabling the firewall exposes the server to all network threats. Instead, create specific inbound rules for required services like SQL Server (port 1433), Remote Desktop (port 3389), and file sharing. This principle of least privilege ensures only necessary traffic reaches the server while maintaining a secure perimeter.