Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts

高等級 1人工審核mssql

說明

The SYSADMIN role is the highest privileged server-level role in SQL Server database engine. Moreover, by design built-in accounts by default are granted permission to this server-level role by Microsoft design so database engine works as expected. The following virtual accounts / Service SIDs are default members of SYSADMIN: NT SERVICE\SQLWriter NT SERVICE\Winmgmt NT SERVICE\MSSQLSERVER (Used by the SQL database engine service) NT ...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Execute this SQL query to find current service accounts running your SQL Server Engine with SYSADMIN role permission: SELECT distinct(name),type_desc FROM master.sys.server_principals a , sys.dm_server_services b WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 and a.name=b.service_account; Execute this SQL query to list all SQL Server instance principles with SYSADMIN role granted to them: SELECT distinct(name),type_desc FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 AND name not in ( 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt', 'NT SERVICE\MSSQLSERVER', 'NT ...

修補方式

修補方法: 操作指南或基礎設施修補檔

Remove any un-allowed SQL Server accounts which are granted SYSADMIN role using this query: ALTER ROLE SYSADMIN DROP MEMBER <account>;

屬性

作業系統: 不限
標籤: mssqldatabasemanual
參考資料: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 3.12 Ensure the 'SYSADMIN' Role is Limited to Administrative or Built-in Accounts