2.7 Ensure 'Remote Admin Connections' Server Configuration Option is set to '0'

Information

The remote admin connections option controls whether a client application on a remote computer can use the Dedicated Administrator Connection (DAC).

Rationale:

The Dedicated Administrator Connection (DAC) lets an administrator access a running server to execute diagnostic functions or Transact-SQL statements, or to troubleshoot problems on the server, even when the server is locked or running in an abnormal state and not responding to a SQL Server Database Engine connection. In a cluster scenario, the administrator may not actually be logged on to the same node that is currently hosting the SQL Server instance and thus is considered 'remote'. Therefore, this setting should usually be enabled (1) for SQL Server failover clusters; otherwise it should be disabled (0) which is the default.

Solution

Run the following T-SQL command on non-clustered installations:

EXECUTE sp_configure 'remote admin connections', 0;
RECONFIGURE;
GO

Default Value:

By default, this option is disabled (0), only local connections may use the DAC.

References:

https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/remote-admin-connections-server-configuration-option

Notes:

If it's a clustered installation, it must be enabled as a clustered SQL Server cannot bind to localhost and DAC will be unavailable otherwise. Enable it for clustered installations. Disable it for standalone installations where not required.

See Also

https://workbench.cisecurity.org/files/2837

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: MS_SQLDB

Control ID: 9ac038fac2c5d939b924554972ffce88266c32986d5a09672122c7b6d63d8e52