STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Access to linked servers must be disabled or restricted, unless specifically required and approved.

DISA Rule

SV-271299r1108513_rule

Vulnerability Number

V-271299

Group Title

SRG-APP-000141-DB-000093

Rule Version

SQLI-22-007500

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Remove any linked servers and all associated logins that are not authorized.

To remove a linked server and all associated logins run the following:

sp_dropserver 'LinkedServerName', 'droplogins';

To remove a login from a linked server run the following:

EXEC sp_droplinkedsrvlogin 'LoginName', NULL;

Check Contents

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

SELECT name
FROM sys.servers s
WHERE s.is_linked = 1

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Vulnerability Number

V-271299

Documentable

False

Rule Version

SQLI-22-007500

Severity Override Guidance

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

SELECT name
FROM sys.servers s
WHERE s.is_linked = 1

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Check Content Reference

M

Target Key

5677