Server 17.0.5005.3 Enterprise Developer Edition (64-bit) · collected 2026-10-01T18:04:15Z (before) and 2026-10-01T18:04:34Z (after)
| Check | Title | Before | After |
|---|
| MS-01 | sa login enabled or not renamed | 2 finding(s) | pass |
| MS-02 | SQL logins without password policy | 2 finding(s) | pass |
| MS-03 | xp_cmdshell enabled | pass | pass |
| MS-04 | Risky surface options enabled | 1 finding(s) | pass |
| MS-05 | Encrypted connections not forced | 1 finding(s) | pass |
| MS-06 | User database without TDE | 1 finding(s) | pass |
| MS-07 | Audit does not cover key events | 1 finding(s) | pass |
| MS-08 | Unexpected sysadmin members | 2 finding(s) | pass |
| MS-09 | guest user can connect | 1 finding(s) | pass |
| MS-10 | Application login over-privileged | 1 finding(s) | pass |
| MS-11 | TRUSTWORTHY database | 1 finding(s) | pass |
| MS-12 | Cross-database ownership chaining | 1 finding(s) | pass |
| Check | Severity | Status | Object | Detail |
|---|
| MS-01 | High | Finding | sa | The built-in sa login is enabled. |
| MS-01 | High | Finding | sa | The built-in sa login keeps its well-known name. |
| MS-02 | Medium | Finding | sa | CHECK_EXPIRATION off on a sysadmin login. |
| MS-02 | Medium | Finding | clinic_app | CHECK_POLICY off. |
| MS-04 | Medium | Finding | remote access | Remote access (procedure calls from other servers) is enabled. |
| MS-05 | High | Finding | server | Encryption is not forced: a connection made with Encrypt=no was not encrypted; 0 of 1 sessions open at collection were unencrypted. |
| MS-06 | Medium | Finding | clinic | TDE is not enabled. |
| MS-07 | High | Finding | server | No server audit is running. |
| MS-08 | High | Finding | BUILTIN\Administrators | Member of sysadmin but not in the allowed list. |
| MS-08 | High | Finding | NT AUTHORITY\NETWORK SERVICE | Member of sysadmin but not in the allowed list. |
| MS-09 | Medium | Finding | clinic | The guest user has CONNECT. |
| MS-10 | Medium | Finding | clinic_app | Member of fixed database role db_owner. |
| MS-11 | High | Finding | clinic | TRUSTWORTHY is on. |
| MS-12 | Low | Finding | server | Cross-database ownership chaining is on for the whole instance. |