Ensure the SQL Server's SQLAgent Service Account is Not an Administrator

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Verify that the service account (in case of a local or AD account) and service SID are not members of the Windows Administrators group. Verify that the service account for running SQLAgent is not LocalSystem, by executing the below query: SELECT servicename, service_account FROM sys.dm_server_services WHERE servicename LIKE 'SQL Server Agent (%' AND service_account IN ( 'NT AUTHORITY\SYSTEM', 'LocalSystem', 'NT AUTHORITY\LocalSystem' ); If a record is returned then this is a finding and requires remediation. If no record is returned, verify that the account used is not part of the Local ...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.