How to check the SQL sa Login is disabled

04 July,2019 by Jack Vamvas

Often organisations have a   SQL server security policy  dictating the 'sa'  login is disabled. There is some sound reasoning behind this policy. The primary reason is to decreases the surface area available to attack - and is a common principle of security. 

When this is a requirement - I'll  add some code to disable 'sa'  as part of the  build  and certification process. But , from time to time - the 'sa' login will be re enabled, so it's important to build an alerting or reporting mechanism identifying the exception. 

The sql statement to check if 'sa' is disabled.

SELECT name, is_disabled FROM sys.server_principals where name='sa'

To disable the 'sa' login use 

ALTER LOGIN sa DISABLE;

 

Normally - I build these checks into a daily Health Check or a custom alert . 

There are other tactics employed to disguise\block logins to sa - for example , renaming the sa is common method used.

Read more on SQL Server security 

SQL Server Security Violations Report for t-sql tuesday (SQL Server ...

Powershell sql server security audit (SQL Server DBA)

Database Security Countermeasures against hacker attacks (SQL ...


Author: Jack Vamvas (http://www.sqlserver-dba.com)


Share:

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been posted. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment on How to check the SQL sa Login is disabled


sqlserver-dba.com | SQL Server Performance Tuning | SQL Server DBA:Everything | FAQ | Contact|Copyright & Disclaimer