Detections
Analytics

2.16 Ensure no login exists with the name 'sa'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The sa login (e.g. principal) is a widely known and often widely used SQL Server account. Therefore, there should not be a login called sa even when the original sa login ( principal_id = 1 ) has been renamed.

Enforcing this control reduces the probability of an attacker executing brute force attacks against a well-known principal name.

Solution

Execute the appropriate ALTER statement below based on the principal_id returned for the login named sa Replace the <different_name> value within the below syntax and execute to rename the sa login.

USE [master]
GO
-- If principal_id = 1 or the login owns database objects, rename the sa login
ALTER LOGIN [sa] WITH NAME = <different_name>;
GO

Impact:

It is not a good security practice to code applications or scripts to use the sa account. Given that it is a best practice to rename and disable the sa account, some 3rd party applications check for the existence of a login named sa and if it doesn't exist, creates one. Removing the sa login will prevent these scripts and applications from authenticating to the database server and executing required tasks or functions.

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|5.1

Plugin: MS_SQLDB

Control ID: 0c9680dd5866b414e012447c4dd425d3b2d33dfc3c22394f50da9a959977d8d2