TMA-MSSQL2022-3.7

Ensure the SQL Server’s Full-Text Service Account is Not an Administrator

보통레벨 1수동 검토mssql

설명

The service account and/or service SID used by the MSSQLFDLauncher service for a default instance or MSSQLFDLauncher$<InstanceName> service for a named instance should not be a member of the Windows Administrator group either directly or indirectly (via a group). This also means that the account known as LocalSystem (aka NT AUTHORITY\SYSTEM) should not be used for the Full-Text service as this account has higher privileges than the SQL Server service requires. Following the principle of least privilege, the service account should have no more privileges than required to do its job. For SQL Server services, the SQL Server Setup will assign the required permissions directly to the service SID. No additional permissions or privileges should be necessary.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify that the service account (in case of a local or AD account) and service SID are not members of the Windows Administrators group.

조치 방법

조치 방식: 가이드 또는 인프라 패치

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.

속성

운영 체제: 모두
태그: mssqlsqlserver-2022
참고 자료: CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 3.7 Ensure the SQL Server’s Full-Text Service Account is Not an Administrator