STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.

DISA Rule

SV-271268r1136917_rule

Vulnerability Number

V-271268

Group Title

SRG-APP-000080-DB-000063

Rule Version

SQLI-22-004100

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Remove permissions that were identified as not allowed in the check content.

USE Master;

REVOKE <Permission> TO [NT AUTHORITY\SYSTEM]

GO

To grant permissions to services or applications, use the Service SID of the service or a domain service account.

Check Contents

Execute the following queries. The first query checks for clustering and availability groups being provisioned in the database engine. The second query lists permissions granted to the local system account.

SELECT
SERVERPROPERTY('IsClustered') AS [IsClustered],
SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled]

EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM'

SELECT * FROM fn_my_permissions(NULL, 'server')

REVERT

GO

If "IsClustered" returns "1", "IsHadrEnabled" returns "0", and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", "VIEW ANY DATABASE", "VIEW SERVER PERFORMANCE STATE", and "VIEW SERVER SECURITY STATE", this is a finding.

If "IsHadrEnabled" returns "1" and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", "VIEW ANY DATABASE", "VIEW SERVER PERFORMANCE STATE", and "VIEW SERVER SECURITY STATE", this is a finding.

If both "IsClustered" and "IsHadrEnabled" return "0" and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.

Vulnerability Number

V-271268

Documentable

False

Rule Version

SQLI-22-004100

Severity Override Guidance

Execute the following queries. The first query checks for clustering and availability groups being provisioned in the database engine. The second query lists permissions granted to the local system account.

SELECT
SERVERPROPERTY('IsClustered') AS [IsClustered],
SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled]

EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM'

SELECT * FROM fn_my_permissions(NULL, 'server')

REVERT

GO

If "IsClustered" returns "1", "IsHadrEnabled" returns "0", and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", "VIEW ANY DATABASE", "VIEW SERVER PERFORMANCE STATE", and "VIEW SERVER SECURITY STATE", this is a finding.

If "IsHadrEnabled" returns "1" and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", "VIEW ANY DATABASE", "VIEW SERVER PERFORMANCE STATE", and "VIEW SERVER SECURITY STATE", this is a finding.

If both "IsClustered" and "IsHadrEnabled" return "0" and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.

Check Content Reference

M

Target Key

5677