Detections
Analytics

2.13 Ensure the 'sa' Login Account is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The sa account is a widely known and often widely used SQL Server account with sysadmin privileges. This is the original login created during installation and always has the principal_id=1 and sid=0x01

Enforcing this control reduces the probability of an attacker executing brute force attacks against a well-known principal.

Solution

Execute the following T-SQL query:

USE [master]
GO
DECLARE @tsql nvarchar(max)
SET @tsql = 'ALTER LOGIN ' + SUSER_NAME(0x01) + ' DISABLE'
EXEC (@tsql)
GO

Impact:

It is not a good security practice to code applications or scripts to use the sa account. However, if this has been done, disabling the sa account will prevent scripts and applications from authenticating to the database server and executing required tasks or functions.

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|16.8

Plugin: MS_SQLDB

Control ID: 0c94110455448b1ea11109668801f760e4c5454d219c9aad6a461b7563e2052b