Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts

高级别 1人工审核mssql

说明

The SYSADMIN role is the highest privileged server-level role in SQL Server database engine. Moreover, by design built-in accounts by default are granted permission to this server-level role by Microsoft design so database engine works as expected. The following virtual accounts / Service SIDs are default members of SYSADMIN: NT SERVICE\SQLWriter NT SERVICE\Winmgmt NT SERVICE\MSSQLSERVER (Used by the SQL database engine service) NT ...

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Execute this SQL query to find current service accounts running your SQL Server Engine with SYSADMIN role permission: SELECT distinct(name),type_desc FROM master.sys.server_principals a , sys.dm_server_services b WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 and a.name=b.service_account; Execute this SQL query to list all SQL Server instance principles with SYSADMIN role granted to them: SELECT distinct(name),type_desc FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 AND name not in ( 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt', 'NT SERVICE\MSSQLSERVER', 'NT ...

修复方式

修复方法: 操作指南或基础设施补丁

Remove any un-allowed SQL Server accounts which are granted SYSADMIN role using this query: ALTER ROLE SYSADMIN DROP MEMBER <account>;

属性

操作系统: 任意
标签: mssqldatabasemanual
参考: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 3.12 Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts