2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'

Information

The remote admin connections option controls whether a client application on a remote computer can use the Dedicated Administrator Connection (DAC).

Rationale:

The Dedicated Administrator Connection (DAC) lets an administrator access a running server to execute diagnostic functions or Transact-SQL statements, or to troubleshoot problems on the server, even when the server is locked or running in an abnormal state and not responding to a SQL Server Database Engine connection. In a cluster scenario, the administrator may not actually be logged on to the same node that is currently hosting the SQL Server instance and thus is considered 'remote'. Therefore, this setting should usually be enabled (1) for SQL Server failover clusters; otherwise it should be disabled (0) which is the default.

Solution

Run the following T-SQL command on non-clustered installations:

EXECUTE sp_configure 'remote admin connections', 0;
RECONFIGURE;
GO

Default Value:

By default, this option is disabled (0), only local connections may use the DAC.

See Also

https://workbench.cisecurity.org/files/2945

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: 37095ab1e14481581e00f38d6d4ab85d875a509ea307c7d036ae3ea6bf4bd762