STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Default demonstration and sample databases, database objects, and applications must be removed.

DISA Rule

SV-271290r1109112_rule

Vulnerability Number

V-271290

Group Title

SRG-APP-000141-DB-000090

Rule Version

SQLI-22-006900

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Remove all demonstration or sample databases from production instances.

Check Contents

Review vendor documentation and vendor websites to identify vendor-provided demonstration or sample databases, database applications, objects, and files. Review the SQL Server to determine if any of the demonstration and sample databases, database applications, or files are installed in the database or included with the SQL Server Instance.

Run the following query to check for names matching known sample databases. Sample databases may have been renamed, so this is not an exhaustive list.

SELECT name
FROM sys.databases
WHERE name LIKE '%pubs%'
OR name LIKE '%northwind%'
OR name LIKE '%adventureworks%'
OR name LIKE '%wideworldimporters%'
OR name LIKE '%contoso%'

If any sample databases are found, this is a finding.

Vulnerability Number

V-271290

Documentable

False

Rule Version

SQLI-22-006900

Severity Override Guidance

Review vendor documentation and vendor websites to identify vendor-provided demonstration or sample databases, database applications, objects, and files. Review the SQL Server to determine if any of the demonstration and sample databases, database applications, or files are installed in the database or included with the SQL Server Instance.

Run the following query to check for names matching known sample databases. Sample databases may have been renamed, so this is not an exhaustive list.

SELECT name
FROM sys.databases
WHERE name LIKE '%pubs%'
OR name LIKE '%northwind%'
OR name LIKE '%adventureworks%'
OR name LIKE '%wideworldimporters%'
OR name LIKE '%contoso%'

If any sample databases are found, this is a finding.

Check Content Reference

M

Target Key

5677