SQL Server must initiate session auditing upon startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213940	SQL6-D0-004700	SV-213940r879562_rule		Medium

Description
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.

STIG	Date
MS SQL Server 2016 Instance Security Technical Implementation Guide	2023-06-01

Details

Check Text ( C-15157r313603_chk )
When Audits are enabled, they start up when the instance starts. https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 Check if an audit is configured and enabled. Execute the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

Check Text ( C-15157r313603_chk )

When Audits are enabled, they start up when the instance starts.
https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2

Check if an audit is configured and enabled.

Execute the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE status_desc = 'STARTED'

All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

Fix Text (F-15155r313604_fix)
Configure the SQL Audit(s) to automatically start during system start-up. ALTER SERVER AUDIT [] WITH STATE = ON Execute the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.