STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 3 Release: 6 Benchmark Date: 05 Jan 2026:

SQL Server must generate audit records when successful and unsuccessful logons or connection attempts occur.

DISA Rule

SV-214014r1167488_rule

Vulnerability Number

V-214014

Group Title

SRG-APP-000503-DB-000351

Rule Version

SQL6-D0-014800

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Add both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" to the server audit specification.
USE [master];
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF);
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP);
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP);
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);
GO

Alternatively, enable "Both failed and successful logins".

In SQL Management Studio:
Right-click on the instance.
- Select "Properties".
- Select "Security" on the left-hand side.
- Select "Both failed and successful logins".
- Click "OK".

Check Contents

Determine if an audit is configured and started by executing the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status

Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP are included in the server audit specification.

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('SUCCESSFUL_LOGIN_GROUP', 'FAILED_LOGIN_GROUP')

If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are returned in an active audit, this is not a finding.

If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are not in the active audit, determine whether "Both failed and successful logins" is enabled.

In SQL Management Studio:
Right-click on the instance.
- Select "Properties".
- Select "Security" on the left hand side.
- Check the setting for "Login auditing".

If "Both failed and successful logins" is not selected, this is a finding.

Vulnerability Number

V-214014

Documentable

False

Rule Version

SQL6-D0-014800

Severity Override Guidance

Determine if an audit is configured and started by executing the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status

Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP are included in the server audit specification.

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('SUCCESSFUL_LOGIN_GROUP', 'FAILED_LOGIN_GROUP')

If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are returned in an active audit, this is not a finding.

If both "SUCCESSFUL_LOGIN_GROUP" and "FAILED_LOGIN_GROUP" are not in the active audit, determine whether "Both failed and successful logins" is enabled.

In SQL Management Studio:
Right-click on the instance.
- Select "Properties".
- Select "Security" on the left hand side.
- Check the setting for "Login auditing".

If "Both failed and successful logins" is not selected, this is a finding.

Check Content Reference

M

Target Key

3993