Ensure 'MUST_CHANGE' Option is set to 'ON' for All SQL Authenticated Logins

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Using SQL Server Management Studio 1. Open SQL Server Management Studio. 2. Open Object Explorer and connect to the target instance. 3. Navigate to the Logins tab in Object Explorer and expand. Right click on the desired login and select Properties. 4. Verify the User must change password at next login checkbox is checked. Using T-SQL SELECT name ,CAST(LOGINPROPERTY(log.name, N'IsMustChange') AS bit) AS [MustChangePassword],* FROM sys.server_principals AS log WHERE type = 'S' and CAST(LOGINPROPERTY(log.name, N'IsMustChange') AS bit) = 1 Returns "1" row for each new Login that has not been ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set the MUST_CHANGE option for SQL Authenticated logins when creating a login initially: CREATE LOGIN <login_name> WITH PASSWORD = '<password_value>' MUST_CHANGE, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; Set the MUST_CHANGE option for SQL Authenticated logins when resetting a password: ALTER LOGIN <login_name> WITH PASSWORD = '<new_password_value>' MUST_CHANGE;