TMA-MSSQL2022-3.5
Ensure the SQL Server’s MSSQL Service Account is Not an Administrator
Opis
The service account and/or service SID used by the MSSQLSERVER service for a default instance or MSSQL$<InstanceName> service for a named instance should not be a member of the Windows Administrator group either directly or indirectly (via a group). This also means that the account known as LocalSystem (aka NT AUTHORITY\SYSTEM) should not be used for any of the SQL Server services as this account has higher privileges than any of the SQL Server services require. Following the principle of least privilege, the service account should have no more privileges than required to do its job. For SQL Server services, the SQL Server Setup will assign the required permissions directly to the service SID. No additional permissions or privileges should be necessary.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
Verify that the service account for running MSSQL is not LocalSystem, by executing the below query: SELECT servicename, service_account FROM sys.dm_server_services WHERE servicename LIKE 'SQL Server (%' AND service_account IN ( 'NT AUTHORITY\SYSTEM', 'LocalSystem', 'NT AUTHORITY\LocalSystem' ); If a record is returned then this is a finding and requires remediation. If no record is returned, verify that the account used is not part of the Local Administrators group.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- mssqlsqlserver-2022
- Referenca
- CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 3.5 Ensure the SQL Server’s MSSQL Service Account is Not an Administrator