SQL Server 2022 Express Self Patch

A small, dependency-free Windows PowerShell 5.1 script for interactively patching one local standalone SQL Server 2022 Express instance.

Safety boundary

• Selects one local SQL Server 2022 Express instance; never uses /allinstances.
• Requires the current Windows account to be SQL sysadmin.
• Reports the latest full backup time for every database except tempdb.
• Optionally creates COPY_ONLY, CHECKSUM backups of system databases or all databases and requires RESTORE VERIFYONLY WITH CHECKSUM before continuing.
• Downloads only from Microsoft's HTTPS Download Center, or accepts a local SQLServer2022-KB<number>-x64.exe.
• Requires a valid Microsoft Corporation Authenticode signature and requests a Microsoft Defender custom scan when available.
• Does not create scheduled tasks, services, accounts, checkpoints, state files, automatic resume, or forced restart.

This package is for a local standalone SQL Server 2022 Express instance. It is not an Always On, failover-cluster, or remote orchestration tool. Test it in your environment and maintain verified database backups independently.

Install

PowerShell-only install

Open Windows PowerShell as Administrator and run the following commands. They download a pinned bootstrap script, verify its SHA-256 before execution, then download and verify the latest non-prerelease ZIP through the GitHub Releases API. No browser, GitHub sign-in, or Invoke-Expression is used.

$bootstrap = Join-Path $env:TEMP 'Install-SqlExpressSelfPatch-1.0.1.ps1'
Invoke-WebRequest 'https://raw.githubusercontent.com/zymbytskyi/sql-server-2022-express-self-patch/v1.0.1/Install-FromGitHub.ps1' -UseBasicParsing -OutFile $bootstrap
if ((Get-FileHash $bootstrap -Algorithm SHA256).Hash -ne '2073E50C44C255EA090653EA91B6A7CA4DCFAC679ED59AAEA47BC920704E3687') { throw 'Bootstrap SHA-256 mismatch.' }
& $bootstrap

The default installs the latest stable release into C:\SqlExpressSelfPatch. To request this exact release instead, replace the last command with:

& $bootstrap -Version 1.0.1

Release ZIP

Download SqlExpressSelfPatch-v<version>.zip from GitHub Releases and run Install.cmd from the extracted archive. It installs only these files into C:\SqlExpressSelfPatch:

Invoke-SqlExpressSelfPatch.ps1
README.md
LICENSE

The installer requests Administrator elevation, verifies the packaged script SHA-256 from manifest.sha256, and refuses to overwrite an existing install unless you confirm. It stores no credential.

Alternatively, extract the archive directly to C:\. The archive's top-level folder is SqlExpressSelfPatch, so the script lands at:

C:\SqlExpressSelfPatch\Invoke-SqlExpressSelfPatch.ps1

Source checkout

From an elevated Windows PowerShell prompt in the repository:

.\Install-SqlExpressSelfPatch.ps1

Use

Open Windows PowerShell as Administrator:

cd C:\SqlExpressSelfPatch
.\Invoke-SqlExpressSelfPatch.ps1 -CheckOnly
.\Invoke-SqlExpressSelfPatch.ps1

The interactive choices are:

• backup 0: no new backup (default);
• backup 1: COPY_ONLY master, model, and msdb;
• backup 2: COPY_ONLY all system and user databases except tempdb;
• update 1: latest Microsoft SQL Server 2022 CU (default);
• update 2: another local Microsoft-signed SQL Server 2022 update EXE.

If Windows must restart, the script asks first. Run the same script again after startup to display the installed build and current backup history.

Tested baseline

The frozen V1 workflow was tested on 2026-08-12 against SQL Server 2022 Express, patching RTM 16.0.1000.6 to CU26 16.0.4265.3. System-only and all-database backup selections, post-update startup, and the no-pending-reboot check passed. These lab build numbers are evidence, not a pinned update: the default flow discovers Microsoft's current SQL Server 2022 CU.

Requirements

• Windows PowerShell 5.1 or later;
• local Administrator elevation;
• local SQL Server 2022 Express Database Engine;
• Windows authentication with SQL sysadmin permission;
• internet access only when choosing the latest CU download.

See SECURITY.md for reporting security issues.