Ensure Dbcreator and Securityadmin roles are only used as needed

中级别 1人工审核sharepoint

说明

In certain situations, database administrators (DBAs) may want to operate independently from SharePoint 2016 administrators and create and manage all the databases. This is typical in IT environments where security requirements and company policies require a separation of administrator roles. The farm administrator provides SharePoint 2016 database requirements to the DBA, who then creates the... Manual review.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

In SSMS Object Explorer > Security > Server Roles, open dbcreator and securityadmin > Properties > Members. Verify only the accounts that need these roles (SharePoint setup/farm accounts during provisioning) are members.

修复方式

修复方法: 操作指南或基础设施补丁

Remove members that do not need dbcreator or securityadmin (SSMS role Properties > Members, or ALTER SERVER ROLE dbcreator DROP MEMBER [login]).

属性

操作系统: 任意
标签: sharepointsqlleast-privilege
参考: CIS Microsoft SharePoint 2019 Benchmark v1.0.0 - 2.8 Ensure Dbcreator and Securityadmin roles are only used as needed