Ensure the SQL Server's Full-Text Service Account is Not an Administrator

Trung bìnhCấp 1Xem xét thủ côngmssql

Mô tả

The service account and/or service SID used by the MSSQLFDLauncher service for a default instance or MSSQLFDLauncher$<InstanceName> service for a named instance should not be a member of the Windows Administrator group either directly or indirectly (via a group). This also means that the account known as LocalSystem (aka NT AUTHORITY\SYSTEM) should not be used for the Full-Text service as this account has higher privileges than the SQL ... Default: By default, the Service Account (or Service SID) is not a member of the Administrators group.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Verify that the service account (in case of a local or AD account) and service SID are not members of the Windows Administrators group.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: mssqldatabasemanual
Tham chiếu: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 3.7 Ensure the SQL Server's Full-Text Service Account is Not an Administrator