STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must protect its audit configuration from authorized and unauthorized access and modification.

DISA Rule

SV-271283r1108465_rule

Vulnerability Number

V-271283

Group Title

SRG-APP-000121-DB-000202

Rule Version

SQLI-22-006300

Severity

CAT II

CCI(s)

• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

10

Fix Recommendation

Remove audit-related permissions from individuals and roles not authorized to have them.

USE master;
DENY [ALTER ANY SERVER AUDIT] TO [User];
GO

Check Contents

Check the server documentation for a list of approved users with access to SQL Server Audits.

To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission.

Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER:

SELECT login.name, perm.permission_name, perm.state_desc
FROM sys.server_permissions perm
JOIN sys.server_principals login
ON perm.grantee_principal_id = login.principal_id
WHERE permission_name in ('ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT', 'CONTROL SERVER')
and login.name not like '##MS_%';

If unauthorized accounts have these privileges, this is a finding.

Vulnerability Number

V-271283

Documentable

False

Rule Version

SQLI-22-006300

Severity Override Guidance

Check the server documentation for a list of approved users with access to SQL Server Audits.

To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission.

Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER:

SELECT login.name, perm.permission_name, perm.state_desc
FROM sys.server_permissions perm
JOIN sys.server_principals login
ON perm.grantee_principal_id = login.principal_id
WHERE permission_name in ('ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT', 'CONTROL SERVER')
and login.name not like '##MS_%';

If unauthorized accounts have these privileges, this is a finding.

Check Content Reference

M

Target Key

5677