SQL Server processes or services must run under custom, dedicated OS accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-41047	SQL2-00-008900	SV-53422r3_rule		Medium

Description
Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. The concept of separation of duties extends to processes. The DBMS must run under a custom, dedicated OS account. When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions. Similarly, related services must run under dedicated accounts where this is possible. The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx and http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.

Description

Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. The concept of separation of duties extends to processes. The DBMS must run under a custom, dedicated OS account. When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions. Similarly, related services must run under dedicated accounts where this is possible. The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx and http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-47664r6_chk )
Check OS settings to determine whether SQL Server processes are running under a dedicated OS account. If the SQL Server processes are running under shared accounts, this is a finding. From a Command Prompt, type services.msc, and press [ENTER]. Scroll down to the SQL Server Services. SQL Server Services begin with SQL. The following services, when present, should be listed as follows: Service Name: Log On As: SQL Full-text Filter Daemon Launcher: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server [stand-alone]: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server [cluster]: \ SQL Server Agent: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server Analysis Services: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server Browser: Local Service SQL Server Distributed Replay Client: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server Distributed Replay Controller: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server Integration Services 11.0: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server Reporting Services: NT Service\UNIQUE CUSTOM ACCOUNT SQL Server VSS Writer: Local System UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.

Check Text ( C-47664r6_chk )

Check OS settings to determine whether SQL Server processes are running under a dedicated OS account. If the SQL Server processes are running under shared accounts, this is a finding.

From a Command Prompt, type services.msc, and press [ENTER]. Scroll down to the SQL Server Services. SQL Server Services begin with SQL. The following services, when present, should be listed as follows:

Service Name: Log On As:
SQL Full-text Filter Daemon Launcher: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server [stand-alone]: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server [cluster]: \
SQL Server Agent: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server Analysis Services: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server Browser: Local Service
SQL Server Distributed Replay Client: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server Distributed Replay Controller: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server Integration Services 11.0: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server Reporting Services: NT Service\UNIQUE CUSTOM ACCOUNT
SQL Server VSS Writer: Local System

UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.

Fix Text (F-46346r1_fix)
Configure the SQL Server services to use a custom, dedicated OS account.