Detections
Analytics

3.10 Ensure Windows local groups are not SQL Logins

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Local Windows groups should not be used as logins for SQL Server instances.

Allowing local Windows groups as SQL Logins provides a loophole whereby anyone with OS level administrator rights (and no SQL Server rights) could add users to the local Windows groups and thereby give themselves or others access to the SQL Server instance.

Solution

- For each LocalGroupName login, if needed create an equivalent AD group containing only the required user accounts.
 - Add the AD group or individual Windows accounts as a SQL Server login and grant it the permissions required.
 - Drop the LocalGroupName login using the syntax below after replacing <name> USE [master]GODROP LOGIN [<name>]GO

Impact:

Before dropping the local group logins, ensure that alternative AD Groups or Windows logins have been added with equivalent permissions. Otherwise, the SQL Server instance may become totally inaccessible.

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|14.6

Plugin: MS_SQLDB

Control ID: f78f0edb6b89513127b3b82e1ad3b1ed6c377b5c6cdd6be63152eb49afbef2dd