STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

The SQL Server default account [sa] must have its name changed.

DISA Rule

SV-274445r1111103_rule

Vulnerability Number

V-274445

Group Title

SRG-APP-000141-DB-000092

Rule Version

SQLI-22-016300

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Modify the SQL Server's [sa] (system administrator) account by running the following script:

USE master;
GO
ALTER LOGIN [sa] WITH NAME = <new name>
GO

Check Contents

Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query:
USE master;
GO
SELECT *
FROM sys.sql_logins
WHERE [name] = 'sa' OR [principal_id] = 1;
GO

If the login account name "SA" or "sa" appears in the query output, this is a finding.

Vulnerability Number

V-274445

Documentable

False

Rule Version

SQLI-22-016300

Severity Override Guidance

Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query:
USE master;
GO
SELECT *
FROM sys.sql_logins
WHERE [name] = 'sa' OR [principal_id] = 1;
GO

If the login account name "SA" or "sa" appears in the query output, this is a finding.

Check Content Reference

M

Target Key

5677