Microsoft SQL Server
TMA-MSSQL-3.12
Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts
Descrição
The SYSADMIN role is the highest privileged server-level role in SQL Server database engine. Moreover, by design built-in accounts by default are granted permission to this server-level role by Microsoft design so database engine works as expected. The following virtual accounts / Service SIDs are default members of SYSADMIN: NT SERVICE\SQLWriter NT SERVICE\Winmgmt NT SERVICE\MSSQLSERVER (Used by the SQL database engine service) NT ...
Como é verificado
Método de auditoria: Revisão manual
Execute this SQL query to find current service accounts running your SQL Server Engine with SYSADMIN role permission: SELECT distinct(name),type_desc FROM master.sys.server_principals a , sys.dm_server_services b WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 and a.name=b.service_account; Execute this SQL query to list all SQL Server instance principles with SYSADMIN role granted to them: SELECT distinct(name),type_desc FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 AND name not in ( 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt', 'NT SERVICE\MSSQLSERVER', 'NT ...
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Remove any un-allowed SQL Server accounts which are granted SYSADMIN role using this query: ALTER ROLE SYSADMIN DROP MEMBER <account>;
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- mssqldatabasemanual
- Referência
- CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 3.12 Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts