STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server services must be configured to run under unique dedicated user accounts.

DISA Rule

SV-271358r1137659_rule

Vulnerability Number

V-271358

Group Title

SRG-APP-000431-DB-000388

Rule Version

SQLI-22-012400

Severity

CAT II

CCI(s)

• CCI-002530 - Maintain a separate execution domain for each executing system process.

Weight

10

Fix Recommendation

Configure SQL Server services to have a documented, dedicated account.

For nondomain servers, consider using virtual service accounts (VSAs).
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?

For standalone domain-joined servers, consider using managed service accounts.
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?

For clustered instances, consider using group managed service accounts.
For more information, refer to: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?
or
https://learn.microsoft.com/en-us/archive/blogs/markweberblog/group-managed-service-accounts-gmsa-and-sql-server-2016

Check Contents

Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server.

Run the following query in SSMS:

SELECT servicename,service_account FROM sys.dm_server_services

Review the returned results. If any services are configured with the same service account or with an account that is not documented and authorized, this is a finding.

Vulnerability Number

V-271358

Documentable

False

Rule Version

SQLI-22-012400

Severity Override Guidance

Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server.

Run the following query in SSMS:

SELECT servicename,service_account FROM sys.dm_server_services

Review the returned results. If any services are configured with the same service account or with an account that is not documented and authorized, this is a finding.

Check Content Reference

M

Target Key

5677