STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The SQL Server default account [sa] must be disabled.

DISA Rule

SV-274444r1137654_rule

Vulnerability Number

V-274444

Group Title

SRG-APP-000033-DB-000084

Rule Version

SQLI-22-016200

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Modify the enabled flag of SQL Server's [sa] (system administrator) account by running the following script:
USE master;
GO
ALTER LOGIN [sa] DISABLE;
GO

Check Contents

Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query:
USE master;
GO
SELECT name, is_disabled
FROM sys.sql_logins
WHERE principal_id = 1;
GO

Verify that the "name" column contains the current name of the [sa] database server account.

If the "is_disabled" column is not set to "1", this is a finding.

Vulnerability Number

V-274444

Documentable

False

Rule Version

SQLI-22-016200

Severity Override Guidance

Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query:
USE master;
GO
SELECT name, is_disabled
FROM sys.sql_logins
WHERE principal_id = 1;
GO

Verify that the "name" column contains the current name of the [sa] database server account.

If the "is_disabled" column is not set to "1", this is a finding.

Check Content Reference

M

Target Key

5677