Quick Start Guide: Non-Domain Joined MS SQL Database Scanning (GUI)

Owned by Amanda McGown
Last updated: Dec 19, 2023 by Allan Cornwell
2 min read

Overview

This guide will walk through scanning a non-domain joined Microsoft SQL Database using CIS-CAT Pro Assessor v4. If the Database is domain joined, please see the this guide: Quick Start Guide: MSSQL Database Scanning w/ Integrated Security (GUI)

Requirements

Implementation Steps

  1. Change Server Authentication Mode in SSM

    1. In SQL Server Management Studio Object Explorer, right-click the server, and then click Properties.

    2. On the Security page, under Server authentication, select the SQL Server and Windows Authentication mode, and then click OK.

    3. In the SQL Server Management Studio dialog box, click OK to acknowledge the requirement to restart SQL Server.

    4. In Object Explorer, right-click your server, and then click Restart. If SQL Server Agent is running, it must also be restarted.

Ā 

2. For a local assessment, use the following JDBC string format (Using a SQL admin account):

jdbc:sqlserver://hostname;user=MyUserName;password=******;

For a remote assessment, use the following JDBC string format (Using a SQL admin account):

jdbc:sqlserver://CIS-SERVER:1433;databaseName=TestDB;user=db_user;password=db_pass;instanceName=TestInstance;

3. Run the assessment using the GUI or CLI. See this section of the documentation for Workflow steps

Troubleshooting Steps

If the scan is unsuccessful, check the SQL logs for a ā€™Login failed for user' message that matches the username in your JDBC string. Hereā€™s a way to get SQL logs: View the SQL Server error log (SSMS) - SQL Server

See the this section of the documentation for more information on JDBC string structure:
https://ciscat-assessor.docs.cisecurity.org/en/latest/Configuration%20Guide/#database-assessment

Ā 

Copyright Ā© 2022 Center for Internet SecurityĀ® Privacy Policy

Ā