Detections
Analytics

3.3 Ensure 'Orphaned Users' are Dropped From SQL Server Databases

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

A database user for which the corresponding SQL Server login is undefined or is incorrectly defined on a server instance cannot log in to the instance and is referred to as orphaned and should be removed.

Orphan users should be removed to avoid potential misuse of those broken users in any way.

Solution

If the orphaned user cannot or should not be matched to an existing or new login using the Microsoft documented process referenced below, run the following T-SQL query in the appropriate database to remove an orphan user:

USE <database_name>;
GO
DROP USER <username>;

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|16.8

Plugin: MS_SQLDB

Control ID: be11e8f0216114661658ba91850607f275d222f72479f4bc252a6080615fb12b