{"name":"Default user service account","description":"This metric checks whether SQL Server services are running under any of the default accounts, such as localsystem. \r\n\r\nUsing a default account for SQL Server services can be a security risk for two reasons. Firstly, it can give the service a higher level of permissions than it needs. Secondly, isolation is compromised by several services running under the same account. It means that, if one of the services is compromised, all the others running under the same account are vulnerable too.\r\n","tsql":"DECLARE @KeyValue VarChar(500),\r\n        @Data Varchar(255),\r\n        @InstanceName VarChar(200)\r\n\r\nSET @InstanceName = CONVERT(VarChar(200), ISNULL(SERVERPROPERTY('InstanceName'), 'MSSQLSERVER'))\r\nSET @KeyValue = 'SOFTWARE\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL'\r\nEXEC xp_regread 'HKEY_LOCAL_MACHINE',\r\n                @KeyValue,\r\n                @InstanceName,\r\n                @InstanceName OUTPUT\r\n\r\nIF SERVERPROPERTY('InstanceName') IS NULL\r\n  SET @KeyValue = 'SYSTEM\\CurrentControlSet\\Services\\MSSQLSERVER\\'\r\nELSE \r\n  SET @KeyValue = 'SYSTEM\\CurrentControlSet\\Services\\MSSQL$' + CONVERT(VarChar(200), SERVERPROPERTY('InstanceName')) + '\\'\r\nEXEC xp_regread 'HKEY_LOCAL_MACHINE',\r\n                @KeyValue,\r\n                'ObjectName',\r\n                @Data OUTPUT\r\n\r\nIF (@Data LIKE '%local%') OR (@Data LIKE '%network%') OR (@Data LIKE '%admini%')\r\n  SELECT 1 AS IsDefaultAccount\r\nELSE \r\n  SELECT 0 AS IsDefaultAccount\r\n","instances":true,"frequency":86400,"databases":{"mode":1},"rateofchange":false,"metricenabled":true,"alertname":"Insecure user account","alertdescription":"This alert will be raised if you\u2019ve used a default user account instead of a domain account. Isolating services reduces the risk that one compromised service could be used to compromise others. Run separate SQL Server services under separate Windows accounts. Whenever possible, use separate, low-rights Windows or Local user accounts for each SQL Server service. For more information, see Configure Windows Service Accounts and Permissions. http:\/\/msdn.microsoft.com\/en-us\/library\/ms143504.aspx","aboveorbelow":"above","collections":1,"alertenabled":true,"_thresholds_high":{"selected":true,"value":0},"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"targetentitytype":0}