Ensure the SQL Server's SQLAgent Service Account is Not an Administrator

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Verify that the service account (in case of a local or AD account) and service SID are not members of the Windows Administrators group. Verify that the service account for running SQLAgent is not LocalSystem, by executing the below query: SELECT servicename, service_account FROM sys.dm_server_services WHERE servicename LIKE 'SQL Server Agent (%' AND service_account IN ( 'NT AUTHORITY\SYSTEM', 'LocalSystem', 'NT AUTHORITY\LocalSystem' ); If a record is returned then this is a finding and requires remediation. If no record is returned, verify that the account used is not part of the Local ...

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.