June 10, 2021 at 5:55 am
Hi Guys,
i am hardening the SA but disabling it and renaming it according to CIS hardening guide. But found multiple failed login errors in Error logs. Did a further trace using the sql profiler and discover:
Login failed for user 'sa'. Reason:.... Always On Operations Dashboard
i could not found any supporting technote from Microsoft saying that it should be exempted from any further hardening.
did u guys just leave the SA account as it it. If that is the case isn't that non-compliance to the security hardening that is within best practice?
June 11, 2021 at 6:10 am
Thanks for posting your issue and hopefully someone will answer soon.
This is an automated bump to increase visibility of your question.
June 11, 2021 at 2:45 pm
I don't have ALWAYS ON configured on any of my instances as we have a different tool for handling failover.
We also have some 3rd party tools that don't support windows authentication for SQL Server, so we need to have SQL logins enabled. Some of these tools require the sa account (scary, but not a lot I can do about it. They are hard-coded to use sa and explicitly ask for the sa password... these tools end up getting their own Instance as I don't trust them to not screw up other databases on the same instance OR to store the sa password poorly and have it get leaked). So I don't have sa disabled or renamed on all of my instances.
As for renaming the account and disabling it, renaming isn't really required if it is disabled. If a user (hacker) can get into the system enough that they can enable the sa account, they can also look up who is in the sysadmin role and figure out what you renamed it to.
Now, as for that always on operations dashboard error, is your always on configured to be run as SA? Or for that matter, is anything configured to run as sa? Disabling the sa account is a good practice, but disabling the sa account when it is in use is going to be problematic. Having as few users as possible in sysadmin is also best practice, but I wouldn't recommend removing everyone.
The above is all just my opinion on what you should do.
As with all advice you find on a random internet forum - you shouldn't blindly follow it. Always test on a test server to see if there is negative side effects before making changes to live!
I recommend you NEVER run "random code" you found online on any system you care about UNLESS you understand and can verify the code OR you don't care if the code trashes your system.
June 15, 2021 at 11:47 am
We implement CIS and have AOAG's the SA account is fully disabled and we dont get the error.
What was the implementation path, did you do the AOAG's before applying CIS. Are the HADR_ENDPOINTS owned by the SA account.
We always apply CIS before any other configuration and that seems to work out great for everything else after the fact.
Viewing 4 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply