STIGQter STIGQter: STIG Summary: Microsoft SQL Server 2022 Database Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Apr 2026:

SQL Server must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

DISA Rule

SV-271179r1108921_rule

Vulnerability Number

V-271179

Group Title

SRG-APP-000266-DB-000162

Rule Version

SQLD-22-002400

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Adjust database code to remove any information not required for explaining the error to an end user.

Consider enabling trace flag 3625 to mask certain system-level error information returned to nonadministrative users.

1. Launch SQL Server Configuration Manager >> SQL Services.
2. Open the instance properties.
3. Select the "Service Parameters" tab.
4. Enter "-T3625".
5. Click "Add" and then click "OK".
6. Restart SQL instance.

Check Contents

Review application behavior and custom database code (stored procedures, triggers), to determine whether error messages contain information beyond what is needed for explaining the issue to general users.

If database error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

Vulnerability Number

V-271179

Documentable

False

Rule Version

SQLD-22-002400

Severity Override Guidance

Review application behavior and custom database code (stored procedures, triggers), to determine whether error messages contain information beyond what is needed for explaining the issue to general users.

If database error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

Check Content Reference

M

Target Key

5676