STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

DISA Rule

SV-271287r1108843_rule

Vulnerability Number

V-271287

Group Title

SRG-APP-000133-DB-000199

Rule Version

SQLI-22-006800

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Reinstall SQL Server application components using dedicated directories that are separate from the operating system.

Relocate or reinstall other application software that currently shares directories with SQL Server components separate from the operating system and/or temporary storage.

Check Contents

Determine the directory in which SQL Server has been installed:

Using SQL Server Management Studio's Object Explorer, right-click [SQL Server Instance], select "Facets", then record the value of RootDirectory.

Determine the Operating System directory:
1. Click "Start".
2. Type "Run".
3. Press "Enter".
4. Type "%windir%".
5. Click "Ok".
6. Record the value in the address bar.

Verify the SQL Server RootDirectory is not in the Operating System directory.

Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding.

Verify the SQL Server RootDirectory is not in another application's directory.

Navigate to the SQL RootDirectory using Windows Explorer.

Examine each directory for evidence another application is stored in it.

If evidence exists the SQL RootDirectory is in another application's directory, this is a finding.

If the SQL RootDirectory is not in the Operating System directory or another application's directory, this is not a finding.

Examples:
1. The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding.

2. The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding.

3. The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.

Vulnerability Number

V-271287

Documentable

False

Rule Version

SQLI-22-006800

Severity Override Guidance

Determine the directory in which SQL Server has been installed:

Using SQL Server Management Studio's Object Explorer, right-click [SQL Server Instance], select "Facets", then record the value of RootDirectory.

Determine the Operating System directory:
1. Click "Start".
2. Type "Run".
3. Press "Enter".
4. Type "%windir%".
5. Click "Ok".
6. Record the value in the address bar.

Verify the SQL Server RootDirectory is not in the Operating System directory.

Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding.

Verify the SQL Server RootDirectory is not in another application's directory.

Navigate to the SQL RootDirectory using Windows Explorer.

Examine each directory for evidence another application is stored in it.

If evidence exists the SQL RootDirectory is in another application's directory, this is a finding.

If the SQL RootDirectory is not in the Operating System directory or another application's directory, this is not a finding.

Examples:
1. The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding.

2. The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding.

3. The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.

Check Content Reference

M

Target Key

5677