TMA-SHAREPOINT-2.8
Ensure Dbcreator and Securityadmin roles are only used as needed
설명
In certain situations, database administrators (DBAs) may want to operate independently from SharePoint 2016 administrators and create and manage all the databases. This is typical in IT environments where security requirements and company policies require a separation of administrator roles. The farm administrator provides SharePoint 2016 database requirements to the DBA, who then creates the... Manual review.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
In SSMS Object Explorer > Security > Server Roles, open dbcreator and securityadmin > Properties > Members. Verify only the accounts that need these roles (SharePoint setup/farm accounts during provisioning) are members.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Remove members that do not need dbcreator or securityadmin (SSMS role Properties > Members, or ALTER SERVER ROLE dbcreator DROP MEMBER [login]).
속성
- 운영 체제
- 모두
- 태그
- sharepointsqlleast-privilege
- 참고 자료
- CIS Microsoft SharePoint 2019 Benchmark v1.0.0 - 2.8 Ensure Dbcreator and Securityadmin roles are only used as needed