Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Execute this SQL query to find current service accounts running your SQL Server Engine with SYSADMIN role permission: SELECT distinct(name),type_desc FROM master.sys.server_principals a , sys.dm_server_services b WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 and a.name=b.service_account; Execute this SQL query to list all SQL Server instance principles with SYSADMIN role granted to them: SELECT distinct(name),type_desc FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 AND name not in ( 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt', 'NT SERVICE\MSSQLSERVER', 'NT ...

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remove any un-allowed SQL Server accounts which are granted SYSADMIN role using this query: ALTER ROLE SYSADMIN DROP MEMBER <account>;