STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.

DISA Rule

SV-271267r1108417_rule

Vulnerability Number

V-271267

Group Title

SRG-APP-000080-DB-000063

Rule Version

SQLI-22-004200

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Remove all logins that were returned in the check content.

Check Contents

Execute the following:

SELECT name
FROM sys.server_principals
WHERE type in ('U','G')
AND name LIKE '%$'

If no logins are returned, this is not a finding.

If logins are returned, determine whether each login is a computer account.

Launch PowerShell and execute the following code:

Note: <name> represents the username portion of the login. For example, if the login is "CONTOSO\user1$", the username is "user1".

([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

If no account information is returned, this is not a finding.

If account information is returned, this is a finding.

Vulnerability Number

V-271267

Documentable

False

Rule Version

SQLI-22-004200

Severity Override Guidance

Execute the following:

SELECT name
FROM sys.server_principals
WHERE type in ('U','G')
AND name LIKE '%$'

If no logins are returned, this is not a finding.

If logins are returned, determine whether each login is a computer account.

Launch PowerShell and execute the following code:

Note: <name> represents the username portion of the login. For example, if the login is "CONTOSO\user1$", the username is "user1".

([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

If no account information is returned, this is not a finding.

If account information is returned, this is a finding.

Check Content Reference

M

Target Key

5677