STIGQter: STIG Summary: Microsoft SQL Server 2022 Database Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Apr 2026:

SQL Server must protect against a user falsely repudiating by ensuring that only unique Active Directory user accounts can connect to the database.

DISA Rule

SV-283667r1192917_rule

Vulnerability Number

V-283667

Group Title

SRG-APP-000080-DB-000063

Rule Version

SQLD-22-004250

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Ensure all logins are uniquely identifiable and authenticate all users who log on to the system. This likely would be done using a combination of Active Directory with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.

Remove any undocumented accounts or shared accounts that cannot be individually authenticated.

Check Contents

Execute the following query:

SELECT name
FROM sys.database_principals
WHERE type in ('U','G')
AND name LIKE '%$'

If no users are returned, this is not a finding.

If users are returned, determine whether each user is a computer account.

Launch PowerShell and execute the following code:

Note: <name> represents the username portion of the user. For example, if the user is "CONTOSO\user1$", the username is "user1".

([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

If no account information is returned, this is not a finding.

If account information is returned, this is a finding.

Vulnerability Number

V-283667

Documentable

False

Rule Version

SQLD-22-004250

Severity Override Guidance

Execute the following query:

SELECT name
FROM sys.database_principals
WHERE type in ('U','G')
AND name LIKE '%$'

If no users are returned, this is not a finding.

If users are returned, determine whether each user is a computer account.

Launch PowerShell and execute the following code:

Note: <name> represents the username portion of the user. For example, if the user is "CONTOSO\user1$", the username is "user1".

([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll()

If no account information is returned, this is not a finding.

If account information is returned, this is a finding.

Check Content Reference

M

Target Key

5676