Ensure 'Control Server' permission is not granted

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Execute this SQL query to list all SQL Server logins with Control Server permission: SELECT sys.server_permissions.type, sys.server_permissions.permission_name, sys.server_permissions.state, sys.server_permissions.state_desc, granteeserverprincipal.name AS grantee_principal_name, granteeserverprincipal.type_desc AS grantee_principal_type_desc, grantorserverprinicipal.name AS grantor_name, CASE WHEN sys.server_permissions.state = N'W' THEN N'GRANT' ELSE sys.server_permissions.state_desc END + N' ' + sys.server_permissions.permission_name COLLATE SQL_Latin1_General_CP1_CI_AS + N' TO ' + QUOTENAME(granteeserverprincipal.name) AS permissionstatement FROM sys.server_principals AS granteeserverprincipal INNER JOIN sys.server_permissions ON sys.server_permissions.grantee_principal_id = granteeserverprincipal.principal_id INNER JOIN sys.server_principals AS grantorserverprinicipal ON grantorserverprinicipal.principal_id = sys.server_permissions.grantor_principal_id WHERE sys.server_permissions.permission_name='CONTROL SERVER' AND granteeserverprincipal.name <> '##MS_PolicySigningCertificate##';

How it is fixed

Fix method: Guidance or infrastructure patch

Remove any un-allowed SQL Server accounts which are granted Control Server using this query: use [master] GO REVOKE CONTROL SERVER FROM <login_name>