Ensure 'MUST_CHANGE' Option is set to 'ON' for All SQL Authenticated Logins

中等級 1人工審核mssql

說明

Whenever this option is set to ON, SQL Server will prompt for an updated password the first time the new or altered login is used. Default: ON when creating a new login via the SSMS GUI. OFF when creating a new login using T-SQL CREATE LOGIN unless the MUST_CHANGE option is explicitly included along with CHECK_EXPIRATION = ON.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Using SQL Server Management Studio 1. Open SQL Server Management Studio. 2. Open Object Explorer and connect to the target instance. 3. Navigate to the Logins tab in Object Explorer and expand. Right click on the desired login and select Properties. 4. Verify the User must change password at next login checkbox is checked. Using T-SQL SELECT name ,CAST(LOGINPROPERTY(log.name, N'IsMustChange') AS bit) AS [MustChangePassword],* FROM sys.server_principals AS log WHERE type = 'S' and CAST(LOGINPROPERTY(log.name, N'IsMustChange') AS bit) = 1 Returns "1" row for each new Login that has not been ...

修補方式

修補方法: 操作指南或基礎設施修補檔

Set the MUST_CHANGE option for SQL Authenticated logins when creating a login initially: CREATE LOGIN <login_name> WITH PASSWORD = '<password_value>' MUST_CHANGE, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; Set the MUST_CHANGE option for SQL Authenticated logins when resetting a password: ALTER LOGIN <login_name> WITH PASSWORD = '<new_password_value>' MUST_CHANGE;

屬性

作業系統: 不限
標籤: mssqldatabasemanual
參考資料: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 4.1 Ensure 'MUST_CHANGE' Option is set to 'ON' for All SQL Authenticated Logins