Title: DBMS default accounts must be assigned custom passwords.
Vulnerability ID: V-32472
STIG ID: SRG-APP-000174-DB-000078
IA Controls: None
Description: Password maximum lifetime is the maximum period of time, (typically in days) a user’s password may be in effect before the user is forced to change it. Passwords need to be changed at specific policy based intervals as per policy. Any password no matter how complex can eventually be cracked. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords there is the risk that the system and/or application passwords could be compromised. DBMS default passwords provide a commonly known and exploited means for unauthorized access to database installations..
Check Text: Review the list of DBMS user accounts. Confirm or verify all accounts created by the DBMS installation. Obtain default password information for the default accounts in vendor documentation, through Internet searches, or other means, if possible.
Test accounts for passwords set to default values. If any are found, this is a finding.
Fix Text: Change passwords for DBMS accounts to non-default values. Where necessary, unlock or enable accounts to change the password and then return the account to disabled or locked status.
SQL Server does not set default password when an install of an instance is done. The install prompts for passwords. If an application or installation script is being used that performs the installation, there should be accompanying documentation stating what the password is. If there is no documentation you will need to login to the SQL Server with an administrative account, usually a local admin account will work, and change the SQL Server generated user account passwords.
If the generated accounts are disabled when they are checked, you should enable them, change the passwords, and then disable the account again as a precautionary step.