STIGQter STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must reveal detailed error messages only to documented and approved individuals or roles.

DISA Rule

SV-271334r1109125_rule

Vulnerability Number

V-271334

Group Title

SRG-APP-000267-DB-000163

Rule Version

SQLI-22-010100

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure audit logging, tracing, and/or custom code in the database or application to record detailed error messages generated by SQL Server for review by authorized personnel.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions.

Consider enabling trace flag 3625 to mask certain system-level error information returned to nonadministrative users.

Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio, use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions.

Enable trace flag 3625 to mask certain system-level error information returned to nonadministrative users.

To launch SQL Server Configuration Manager, select SQL Server Services, select the SQL Server, then right-click and select "Properties". Select the "Startup Parameters" tab, enter "-T3625", and then click "Add". Click "OK", then restart SQL instance.

Check Contents

Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code review practices.

SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script:

USE master
GO
SELECT Name
FROM syslogins
WHERE (sysadmin = 1 or securityadmin = 1)
and hasaccess = 1;

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding.

In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio or if documentation does not exist stating that full error messages must be returned, this is a finding.

Otherwise, verify if trace flag 3625 is enabled to mask certain system-level error information returned to nonadministrative users.

Launch SQL Server Configuration Manager >> select SQL Server Services >> select the SQL Server >> right-click and select Properties >> select Startup Parameters tab >> verify -T3625 exists in the dialogue window.

OR

Run the query:
DBCC TRACESTATUS;

If TraceFlag 3625 does not return with Status = 1, and if documentation does not exist stating that full error messages must be returned, this is a finding.

Vulnerability Number

V-271334

Documentable

False

Rule Version

SQLI-22-010100

Severity Override Guidance

Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code review practices.

SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script:

USE master
GO
SELECT Name
FROM syslogins
WHERE (sysadmin = 1 or securityadmin = 1)
and hasaccess = 1;

If any nonauthorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding.

In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed.

If any nonauthorized users have access to the SQL Server Error Log in SQL Server Management Studio or if documentation does not exist stating that full error messages must be returned, this is a finding.

Otherwise, verify if trace flag 3625 is enabled to mask certain system-level error information returned to nonadministrative users.

Launch SQL Server Configuration Manager >> select SQL Server Services >> select the SQL Server >> right-click and select Properties >> select Startup Parameters tab >> verify -T3625 exists in the dialogue window.

OR

Run the query:
DBCC TRACESTATUS;

If TraceFlag 3625 does not return with Status = 1, and if documentation does not exist stating that full error messages must be returned, this is a finding.

Check Content Reference

M

Target Key

5677