Detections
Analytics
SQLI-22-012400 - SQL Server services must be configured to run under unique dedicated user accounts.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure SQL Server services to have a documented, dedicated account.For nondomain servers, consider using virtual service accounts (VSAs).
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?
For standalone domain-joined servers, consider using managed service accounts.
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?
For clustered instances, consider using group managed service accounts.
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?
or
https://learn.microsoft.com/en-us/archive/blogs/markweberblog/group-managed-service-accounts-gmsa-and-sql-server-2016
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2022_Y26M01_STIG.zip
Item Details
References: CAT|II, CCI|CCI-002530, Rule-ID|SV-271358r1137659_rule, STIG-ID|SQLI-22-012400, Vuln-ID|V-271358
Plugin: MS_SQLDB
Control ID: 772589cd434c27f3d48c22f864511ba948a42d66199e092264173bfdd1d18953