STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must limit privileges to change software modules and links to software external to SQL Server.

DISA Rule

SV-271285r1109236_rule

Vulnerability Number

V-271285

Group Title

SRG-APP-000133-DB-000179

Rule Version

SQLI-22-006500

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.

Check Contents

Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk.

If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding.

To determine the location for these instance-specific binaries:

1. Launch SQL Server Management Studio (SSMS).
2. Connect to the instance to be reviewed.
3. Right-click server name in "Object Explorer".
4. Click "Facets".
5. Select the "Server" facet.
6. Record the value for the "RootDirectory" facet property.
7. Navigate to the folder above and review the "Binn" subdirectory.

TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.

Vulnerability Number

V-271285

Documentable

False

Rule Version

SQLI-22-006500

Severity Override Guidance

Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk.

If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding.

To determine the location for these instance-specific binaries:

1. Launch SQL Server Management Studio (SSMS).
2. Connect to the instance to be reviewed.
3. Right-click server name in "Object Explorer".
4. Click "Facets".
5. Select the "Server" facet.
6. Record the value for the "RootDirectory" facet property.
7. Navigate to the folder above and review the "Binn" subdirectory.

TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.

Check Content Reference

M

Target Key

5677