Issues
HighSurface Area
Risky Server Features Enabled
Found 1 surface area feature(s) enabled.
Why: Unused features like xp_cmdshell or OLE increase attack surface.
Attack: An attacker abuses enabled features to execute OS commands or access external data.
Verify: SELECT name, value_in_use FROM sys.configurations WHERE name IN ( 'xp_cmdshell','Ad Hoc Distributed Queries','Ole Automation Procedures', 'SQL Mail XPs','Database Mail XPs','clr enabled','external scripts enabled' );
Control ID: SA-010 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 3.1
remote access
Disable unused surface area features (xp_cmdshell, Ad Hoc Distributed Queries, Ole Automation, CLR, external scripts, mail) unless required.
HighNetwork/Endpoints
Public CONNECT on Endpoints
Found 4 endpoint CONNECT grant(s) to public.
Why: Public CONNECT allows any login to access endpoints and expand exposure.
Attack: An attacker connects to endpoints granted to public to reach sensitive services.
Verify: SELECT e.name, pr.name, pe.state_desc FROM sys.server_permissions pe JOIN sys.endpoints e ON pe.major_id = e.endpoint_id JOIN sys.server_principals pr ON pe.grantee_principal_id = pr.principal_id WHERE pe.permission_name = 'CONNECT' AND pr.name = 'public' AND pe.state IN ('G','W');
Control ID: SA-025 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
TSQL Default TCP (TSQL)
TSQL Default VIA (TSQL)
TSQL Local Machine (TSQL)
TSQL Named Pipes (TSQL)
Revoke CONNECT on endpoints from public and grant only to required principals.
MediumServer Permissions
Wide-Read / Recon Server Permissions Granted
Found 2 server permission grant(s) that enable broad recon (VIEW SERVER STATE / VIEW ANY DB / CONNECT ANY DB / IMPERSONATE ANY LOGIN).
Why: Recon permissions expose metadata and help attackers map the environment.
Attack: An attacker uses VIEW SERVER STATE/VIEW ANY DATABASE to enumerate targets and plan escalation.
Verify: SELECT pr.name, pe.permission_name, pe.state_desc FROM sys.server_permissions pe JOIN sys.server_principals pr ON pe.grantee_principal_id = pr.principal_id WHERE pe.permission_name IN ('VIEW SERVER STATE','VIEW ANY DATABASE','CONNECT ANY DATABASE','IMPERSONATE ANY LOGIN') AND pe.state IN ('G','W');
Control ID: SA-004 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 2.3
public: VIEW ANY DATABASE [GRANT]
PerfTuningUser: VIEW SERVER STATE [GRANT]
Limit recon-style server permissions to administrators and monitoring accounts only.
MediumAuthentication
Weak Password Policies
Found 3 SQL login(s) without password policy or expiration enforcement.
Why: Disabling password policy or expiration weakens account hygiene.
Attack: Attackers exploit long-lived weak passwords to gain access.
Verify: SELECT name, is_policy_checked, is_expiration_checked FROM sys.sql_logins WHERE is_disabled = 0 AND (is_policy_checked = 0 OR is_expiration_checked = 0);
Control ID: SA-009 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 2.4
Policy OFF: sa, PerfTuningUser, adamsmith
Expiration OFF: sa, PerfTuningUser, adamsmith
Enable CHECK_POLICY and CHECK_EXPIRATION for SQL logins.
MediumNetwork/Endpoints
Force Encryption Disabled
Force Encryption appears to be disabled for SQL Server network connections.
Why: Unencrypted connections expose credentials and data in transit.
Attack: An attacker sniffs network traffic to capture sensitive data.
Verify: DECLARE @force_encryption INT; EXEC master..xp_instance_regread N'HKEY_LOCAL_MACHINE', N'SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQLServer\\SuperSocketNetLib', N'ForceEncryption', @force_encryption OUTPUT; SELECT @force_encryption AS force_encryption;
Control ID: SA-026 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 5.1
Enable Force Encryption if supported by your certificate/OS configuration and client requirements.
MediumNetwork/Authentication
NTLM Authentication Detected (Kerberos Fallback)
Detected 6 NTLM-authenticated user session(s). This may indicate Kerberos fallback or SPN/delegation issues.
Why: NTLM is weaker than Kerberos and may indicate authentication downgrade.
Attack: An attacker leverages NTLM relay or downgrade to gain access.
Verify: SELECT c.auth_scheme, c.encrypt_option, c.net_transport, COUNT(*) AS session_count FROM sys.dm_exec_connections c JOIN sys.dm_exec_sessions s ON c.session_id = s.session_id WHERE s.is_user_process = 1 AND c.auth_scheme = 'NTLM' GROUP BY c.auth_scheme, c.encrypt_option, c.net_transport;
Control ID: SA-028 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
NTLM via Shared memory: 6 (encrypt=FALSE)
Sample: MSSQL2022-01\sqlrunner @ MSSQL2022-01 (SQLAgent - TSQL JobStep (Job 0x889CDD1089323749B2FED95F127AB6FE : Step 1))
Sample: MSSQL2022-01\sqlrunner @ MSSQL2022-01 (SQLAgent - Contained AG)
Sample: MSSQL2022-01\sqlrunner @ MSSQL2022-01 (SQLAgent - Email Logger)
Sample: MSSQL2022-01\sqlrunner @ MSSQL2022-01 (SQLAgent - Job invocation engine)
Sample: MSSQL2022-01\sqlrunner @ MSSQL2022-01 (SQLAgent - Generic Refresher)
Review SPN configuration, delegation settings, and client connection settings to prefer Kerberos where applicable.
MediumNetwork/Encryption
Unencrypted TCP Connections Detected
Some active TCP connections are not encrypted (best-effort from sys.dm_exec_connections).
Why: Unencrypted TCP connections expose data in transit.
Attack: A network attacker captures plaintext data or credentials.
Verify: SELECT c.auth_scheme, c.encrypt_option, c.net_transport, COUNT(*) AS session_count FROM sys.dm_exec_connections c JOIN sys.dm_exec_sessions s ON c.session_id = s.session_id WHERE s.is_user_process = 1 AND c.net_transport = 'TCP' AND c.encrypt_option = 'FALSE' GROUP BY c.auth_scheme, c.encrypt_option, c.net_transport;
Control ID: SA-030 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
SQL over TCP: 1
Require encrypted connections and validate TLS configuration on server and clients.
MediumSQL Agent
Sysadmin-Owned CmdExec/PowerShell Jobs (RunAs Proxy)
Found 1 job step(s) using CmdExec/PowerShell owned by sysadmin and running under a proxy.
Why: Proxy accounts can grant OS access and must be least-privilege even for sysadmin jobs.
Attack: A job runs OS commands under an over-privileged proxy account.
Verify: SELECT j.name, js.step_id, js.subsystem, js.proxy_id, p.name AS proxy_name FROM msdb.dbo.sysjobs j JOIN msdb.dbo.sysjobsteps js ON j.job_id = js.job_id JOIN msdb.dbo.sysproxies p ON js.proxy_id = p.proxy_id LEFT JOIN sys.server_principals sp ON j.owner_sid = sp.sid LEFT JOIN sys.server_role_members srm ON srm.member_principal_id = sp.principal_id LEFT JOIN sys.server_principals sa ON srm.role_principal_id = sa.principal_id AND sa.name = 'sysadmin' WHERE js.subsystem IN ('CmdExec','PowerShell') AND sa.name = 'sysadmin' AND js.proxy_id <> 0;
Control ID: SA-041 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
syspolicy_purge_history / Step 3: PowerShell (RunAs: None)
Review proxy account permissions and ensure least-privilege; avoid unnecessary OS-level execution.
MediumPatch Management
Missing Cumulative Update Level
SQL Server update level (CU/GDR) information is missing; instance may be unpatched.
Why: Unknown update level may indicate missing security patches.
Attack: Attackers exploit known vulnerabilities on unpatched instances.
Verify: SELECT SERVERPROPERTY('ProductVersion') AS product_version, SERVERPROPERTY('ProductLevel') AS product_level, SERVERPROPERTY('ProductUpdateLevel') AS update_level;
Control ID: SA-045 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
Version: 16.0.1000.6
Level: RTM
Edition: Developer Edition (64-bit)
Verify the latest security/CU update and apply if necessary.
MediumServer Critical Events
Repeated Server Restart or Failover Signals
Repeated restart, recovery, or availability-group failover messages were found in the SQL Server error log. This can affect availability and may hide security-relevant service interruptions.
Why: Repeated restarts or failovers can indicate unstable infrastructure, failed patching, or unplanned service interruption.
Attack: An attacker triggers or hides disruptive activity behind repeated service restarts or availability-group failovers.
Verify: EXEC xp_readerrorlog 0, 1; -- filter for startup, recovery, availability group, and failover messages
Control ID: SA-068 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Operational Monitoring
Restart/recovery events: 2
2026-05-30 10:31:59.780000: Recovery is complete. This is an informational message only. No user action is required.
2026-05-30 10:31:10.980000: SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
Review SQL Server service uptime, cluster/AG health, Windows event logs, and recent patch or maintenance activity.
MediumMonitoring & Audit
SQL Server Audit Not Enabled
No enabled SQL Server Audit was found. This reduces visibility into security-relevant activity.
Why: Without auditing, security events may go undetected.
Attack: An attacker changes permissions without an audit trail.
Verify: SELECT name, is_state_enabled FROM sys.server_audits WHERE is_state_enabled = 1;
Control ID: SA-057 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 6.1
Configure SQL Server Audit and enable server/database audit specifications for key security events.
MediumMonitoring & Audit
Server Audit Specifications Not Enabled
No enabled server audit specification was found.
Why: Without audit specifications, important server events are not captured.
Attack: Privilege or configuration changes occur without logging.
Verify: SELECT name, is_state_enabled FROM sys.server_audit_specifications WHERE is_state_enabled = 1;
Control ID: SA-058 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
Enable server audit specifications for login changes, permission changes, and schema changes as appropriate.
LowAuthentication
Built-in SA Login Not Renamed
The built-in SQL Server administrator login still uses the default name 'sa'.
Why: The built-in SQL Server administrator login still uses the default name 'sa'.
Control ID: SA-UNK | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS Microsoft SQL Server 2022 Benchmark - TBD
Rename the built-in administrator login and keep it disabled unless a specific break-glass scenario requires it.
LowAuthorization
Modules Using EXECUTE AS
Found 33 stored procedures/functions using EXECUTE AS (review for privilege escalation paths).
Why: EXECUTE AS modules run under another principal and must be tightly controlled.
Attack: A vulnerable module executes with elevated rights and is abused for escalation.
Verify: SELECT s.name AS schema_name, o.name AS object_name, USER_NAME(o.execute_as_principal_id) AS execute_as FROM sys.objects o JOIN sys.schemas s ON o.schema_id = s.schema_id WHERE o.execute_as_principal_id IS NOT NULL AND o.type IN ('P','V','FN','IF','TF');
Control ID: SA-022 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
Application.AddRoleMemberIfNonexistent EXECUTE AS None
Application.Configuration_ApplyColumnstoreIndexing EXECUTE AS None
Application.Configuration_ApplyFullTextIndexing EXECUTE AS None
Application.Configuration_ApplyPartitioning EXECUTE AS None
Application.Configuration_ApplyRowLevelSecurity EXECUTE AS None
Application.Configuration_RemoveRowLevelSecurity EXECUTE AS None
Application.CreateRoleIfNonexistent EXECUTE AS None
DataLoadSimulation.Configuration_ApplyDataLoadSimulationProcedures EXECUTE AS None
DataLoadSimulation.Configuration_RemoveDataLoadSimulationProcedures EXECUTE AS None
Integration.GetCityUpdates EXECUTE AS None
... (+23 more)
Ensure EXECUTE AS modules are least-privilege and only trusted principals can EXECUTE them.
LowNetwork/Authentication
No Kerberos Connections Observed
Windows-authenticated sessions are present, but none are using Kerberos (best-effort from active connections).
Why: Kerberos not observed may indicate SPN/delegation misconfiguration.
Attack: Clients fall back to NTLM, reducing authentication strength.
Verify: SELECT c.auth_scheme, COUNT(*) AS session_count FROM sys.dm_exec_connections c JOIN sys.dm_exec_sessions s ON c.session_id = s.session_id WHERE s.is_user_process = 1 GROUP BY c.auth_scheme;
Control ID: SA-029 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
Check SPNs, DNS, and delegation. If Kerberos is required, validate client and server configuration.
LowSQL Agent
Frequently Scheduled Agent Jobs
Found 1 SQL Agent job schedule(s) running very frequently. Frequent schedules can amplify job abuse, resource exhaustion, or credential misuse impact.
Why: Found 1 SQL Agent job schedule(s) running very frequently. Frequent schedules can amplify job abuse, resource exhaustion, or credential misuse impact.
Control ID: SA-UNK | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS Microsoft SQL Server 2022 Benchmark - TBD
WWI_Workload_Stress_v2_Job / Every1Minute_v2 (subday_type=4, interval=1, run_as=None)
Review high-frequency job schedules, especially OS-level jobs, and confirm they are operationally necessary and resource-safe.
LowAuthorization
Public Role Has Extra Permissions
Across the instance, public has 217 object/schema permission grant(s) in 1 database(s). Most risky DB: WideWorldImporters (217 perms). Breakdown: DML=217, EXEC=0, CONTROL/ALTER=0.
Why: Public permissions apply to all users and increase exposure.
Attack: Any login can access objects granted to public.
Verify: SELECT permission_name, class_desc, OBJECT_NAME(major_id) AS object_name FROM sys.database_permissions WHERE grantee_principal_id = DATABASE_PRINCIPAL_ID('public') AND permission_name NOT IN ('CONNECT') AND class_desc <> 'DATABASE';
Control ID: SA-052 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
WideWorldImporters: 217 perms (DML: 217, EXEC: 0, CONTROL/ALTER: 0)
Remove object/schema grants from public; grant to least-privilege roles/groups.
LowMonitoring & Audit
Database Audit Specifications Not Enabled (Current DB)
No enabled database audit specification was found for the current database.
Why: Database-level changes may not be audited without specs.
Attack: Schema or permission changes occur without detection.
Verify: SELECT name, is_state_enabled FROM sys.database_audit_specifications WHERE is_state_enabled = 1;
Control ID: SA-059 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
Consider enabling DB audit specifications for schema/permission changes in sensitive databases.
LowEncryption
No TDE-Encrypted User Databases Detected
No user database appears to be in 'Encrypted' state (TDE). This may be fine depending on policy, but is worth reviewing for sensitive data.
Why: Data at rest may be unencrypted without TDE.
Attack: Stolen disks or backups expose plaintext data.
Verify: SELECT d.name, dek.encryption_state FROM sys.databases d LEFT JOIN sys.dm_database_encryption_keys dek ON d.database_id = dek.database_id WHERE d.name NOT IN ('master','model','msdb','tempdb');
Control ID: SA-063 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Section 5.2
WideWorldImporters
Enable TDE for sensitive databases where appropriate; ensure key management and backups are handled securely.
InfoEncryption
Always Encrypted Not Configured (Current DB)
No Always Encrypted column master/encryption keys were found in the current database.
Why: Sensitive columns may not be protected in use without Always Encrypted.
Attack: A privileged DB user or attacker reads sensitive columns in plaintext.
Verify: SELECT (SELECT COUNT(*) FROM sys.column_master_keys) AS cmk_count, (SELECT COUNT(*) FROM sys.column_encryption_keys) AS cek_count;
Control ID: SA-065 | Compliance: PCI-DSS; ISO 27001; SOC2; HIPAA | CIS: CIS SQL Server 2022 v1.1.0 – Relevant Section (Account / Surface Area / Audit / Encryption)
If you store highly sensitive columns, consider Always Encrypted or column-level encryption per policy.