4.4 Ensure No Users Are Assigned the 'DEFAULT' Profile


Upon creation database users are assigned to the DEFAULT profile unless otherwise specified. No users should be assigned to that profile.


Users should be created with function-appropriate profiles. The DEFAULT profile, being defined by Oracle, is subject to change at any time (e.g. by patch or version update). The DEFAULT profile has unlimited settings that are often required by the SYS user when patching; such unlimited settings should be tightly reserved and not applied to unnecessary users.


To remediate this recommendation, execute the following SQL statement for each user returned by the audit query using a functional-appropriate profile, keeping in mind if this is granted in both container and pluggable database, you must connect to both places to revoke.

ALTER USER <username> PROFILE <appropriate_profile>;

See Also