Ensure the SQL Server's SQLAgent Service Account is Not an Administrator

高级别 1人工审核mssql

说明

The service account and/or service SID used by the SQLSERVERAGENT service for a default instance or SQLAGENT$<InstanceName> service for a named instance should not be a member of the Windows Administrator group either directly or indirectly (via a group). This also means that the account known as LocalSystem (AKA NT AUTHORITY\SYSTEM) should not be used for the SQLAGENT service as this account has higher privileges than the SQL Server service ... Default: By default, the Service Account (or Service SID) is not a member of the Administrators group.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Verify that the service account (in case of a local or AD account) and service SID are not members of the Windows Administrators group. Verify that the service account for running SQLAgent is not LocalSystem, by executing the below query: SELECT servicename, service_account FROM sys.dm_server_services WHERE servicename LIKE 'SQL Server Agent (%' AND service_account IN ( 'NT AUTHORITY\SYSTEM', 'LocalSystem', 'NT AUTHORITY\LocalSystem' ); If a record is returned then this is a finding and requires remediation. If no record is returned, verify that the account used is not part of the Local ...

修复方式

修复方法: 操作指南或基础设施补丁

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.

属性

操作系统: 任意
标签: mssqldatabasemanual
参考: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 3.6 Ensure the SQL Server's SQLAgent Service Account is Not an Administrator