3.4 Ensure the SQL Server's MSSQL Service Account is Not an Administrator

Information

The service account and/or service SID used by the MSSQLSERVER service for a default instance or MSSQL$<InstanceName> service for a named instance should not be a member of the Windows Administrator group either directly or indirectly (via a group). This also means that the account known as LocalSystem (aka NT AUTHORITY\SYSTEM) should not be used for the MSSQL service as this account has higher privileges than the SQL Server service requires.

Rationale:

Following the principle of least privilege, the service account should have no more privileges than required to do its job. For SQL Server services, the SQL Server Setup will assign the required permissions directly to the service SID. No additional permissions or privileges should be necessary.

Solution

In the case where LocalSystem is used, use SQL Server Configuration Manager to change to a less privileged account. Otherwise, remove the account or service SID from the Administrators group. You may need to run the SQL Server Configuration Manager if underlying permissions had been changed or if SQL Server Configuration Manager was not originally used to set the service account.

Impact:

The SQL Server Configuration Manager tool should always be used to change the SQL Server's service account. This will ensure that the account has the necessary privileges. If the service needs access to resources other than the standard Microsoft defined directories and registry, then additional permissions may need to be granted separately to those resources.

Default Value:

By default, the Service Account (or Service SID) is not a member of the Administrators group.

References:

https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions

See Also

https://workbench.cisecurity.org/files/2834

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(9), CSCv6|5.1, CSCv7|4.3

Plugin: Windows

Control ID: 04f8ed74d96b3e23809b9558b144182c679bdc6bcd889611e0aa7631288ce68e