Ensure 'Control Server' permission is not granted

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Execute this SQL query to list all SQL Server logins with Control Server permission: SELECT sys.server_permissions.type, sys.server_permissions.permission_name, sys.server_permissions.state, sys.server_permissions.state_desc, granteeserverprincipal.name AS grantee_principal_name, granteeserverprincipal.type_desc AS grantee_principal_type_desc, grantorserverprinicipal.name AS grantor_name, CASE WHEN sys.server_permissions.state = N'W' THEN N'GRANT' ELSE sys.server_permissions.state_desc END + N' ' + sys.server_permissions.permission_name COLLATE SQL_Latin1_General_CP1_CI_AS + N' TO ' + QUOTENAME(granteeserverprincipal.name) AS permissionstatement FROM sys.server_principals AS granteeserverprincipal INNER JOIN sys.server_permissions ON sys.server_permissions.grantee_principal_id = granteeserverprincipal.principal_id INNER JOIN sys.server_principals AS grantorserverprinicipal ON grantorserverprinicipal.principal_id = sys.server_permissions.grantor_principal_id WHERE sys.server_permissions.permission_name='CONTROL SERVER' AND granteeserverprincipal.name <> '##MS_PolicySigningCertificate##';

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove any un-allowed SQL Server accounts which are granted Control Server using this query: use [master] GO REVOKE CONTROL SERVER FROM <login_name>