STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must, for password-based authentication, require immediate selection of a new password upon account recovery.

DISA Rule

SV-271400r1167497_rule

Vulnerability Number

V-271400

Group Title

SRG-APP-000855-DB-000240

Rule Version

SQLI-22-019500

Severity

CAT II

CCI(s)

• CCI-004063 - For password-based authentication, require immediate selection of a new password upon account recovery.

Weight

10

Fix Recommendation

Configure the DBMS to require immediate selection of a new password for accounts using SQL login upon account recovery.

Ensure all scripts, functions, triggers, and stored procedures used to create a user or reset a user's password for SQL logins include a line similar to the following password_option:

MUST_CHANGE

If MUST_CHANGE is specified, CHECK_EXPIRATION and CHECK_POLICY must be set to ON. Otherwise, the statement will fail.

More information can be found at https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-login-transact-sql?view=sql-server-ver16.

Check Contents

Check for use of SQL Server Authentication:

SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode]

If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding.

If the returned value is not "Windows Authentication", verify SQL Server is configured to require immediate selection of a new password upon account recovery.

All scripts, functions, triggers, and stored procedures used to create a user or reset a user's password for SQL logins should include a line similar to the following password_option:

MUST_CHANGE

Example:
CREATE LOGIN STIG_test WITH PASSWORD ='Password' MUST_CHANGE,
CHECK_EXPIRATION = ON,
CHECK_POLICY = ON;

If they do not, this is a finding.

If SQL Server is not configured to require immediate selection of a new password upon account recovery for accounts using SQL login, this is a finding.

Vulnerability Number

V-271400

Documentable

False

Rule Version

SQLI-22-019500

Severity Override Guidance

Check for use of SQL Server Authentication:

SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode]

If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding.

If the returned value is not "Windows Authentication", verify SQL Server is configured to require immediate selection of a new password upon account recovery.

All scripts, functions, triggers, and stored procedures used to create a user or reset a user's password for SQL logins should include a line similar to the following password_option:

MUST_CHANGE

Example:
CREATE LOGIN STIG_test WITH PASSWORD ='Password' MUST_CHANGE,
CHECK_EXPIRATION = ON,
CHECK_POLICY = ON;

If they do not, this is a finding.

If SQL Server is not configured to require immediate selection of a new password upon account recovery for accounts using SQL login, this is a finding.

Check Content Reference

M

Target Key

5677