STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must prevent unauthorized and unintended information transfer via Instant File Initialization (IFI).

DISA Rule

SV-271327r1137657_rule

Vulnerability Number

V-271327

Group Title

SRG-APP-000243-DB-000373

Rule Version

SQLI-22-009900

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.

Weight

10

Fix Recommendation

If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" local rights assignment.

To grant an account the "Perform volume maintenance tasks" permission:

1. On the computer where the data file will be created, open the Local Security Policy application (secpol.msc).
2. In the left pane, expand "Local Policies" then select "User Rights Assignment".
3. In the right pane, double-click "Perform volume maintenance tasks".
4. Select "Add User or Group" and add the SQL Server service account.
5. Select "Apply", then close all Local Security Policy dialog boxes.
6. Restart the SQL Server service.
7. Check the SQL Server error log at startup.

Check Contents

Review system configuration to determine whether IFI support has been enabled (IFI is enabled by default).

Run the following query in SSMS:

SELECT
servicename
,instant_file_initialization_enabled
FROM sys.dm_server_services

If the column instant_file_initialization_enabled returns a value of "Y", then IFI is enabled.

Alternatively, navigate to Start >> Control Panel >> System and Security >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment >> Perform volume maintenance tasks.

The default SQL service account for a default instance is NT SERVICE\MSSQLSERVER or for a named instance is NT SERVICE\MSSQL$InstanceName.

If the SQL service account or SQL service SID has been granted "Perform volume maintenance tasks" Local Rights Assignment, this means that IFI is enabled.

Review the system documentation to determine if IFI is required.

If IFI is enabled but not documented as required, this is a finding.

If IFI is not enabled, this is not a finding.

Vulnerability Number

V-271327

Documentable

False

Rule Version

SQLI-22-009900

Severity Override Guidance

Review system configuration to determine whether IFI support has been enabled (IFI is enabled by default).

Run the following query in SSMS:

SELECT
servicename
,instant_file_initialization_enabled
FROM sys.dm_server_services

If the column instant_file_initialization_enabled returns a value of "Y", then IFI is enabled.

Alternatively, navigate to Start >> Control Panel >> System and Security >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment >> Perform volume maintenance tasks.

The default SQL service account for a default instance is NT SERVICE\MSSQLSERVER or for a named instance is NT SERVICE\MSSQL$InstanceName.

If the SQL service account or SQL service SID has been granted "Perform volume maintenance tasks" Local Rights Assignment, this means that IFI is enabled.

Review the system documentation to determine if IFI is required.

If IFI is enabled but not documented as required, this is a finding.

If IFI is not enabled, this is not a finding.

Check Content Reference

M

Target Key

5677