Microsoft SQL Server 2022 Instance STIG

Microsoft SQL Server 2022 Instance Security Technical Implementation Guide

The Microsoft SQL Server 2022 Instance Security Technical Implementation Guide (V1 R4) has 79 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

79STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Apr 01 2026 What changed in V1R4

Confidentiality of information during transmission must be controlled through the use of an approved TLS version.

Microsoft SQL Server 2022 Instance Security Technical Implementation Guide

Assessment Title

Rule Text

Confidentiality of information during transmission must be controlled through the use of an approved TLS version.

Description

Discussion Text

Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a FIPS-approved minimum TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev. 2 specifies the preferred configurations for government systems.

References:
TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244
TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-271310

Rule

SV-271310r1111062_rule

Severity

high

Rule Version

SQLI-22-008300

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Access the SQL Server.
Access an administrator command prompt.
Type "regedit" to launch the Registry Editor.
 
Navigate to:
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2

If this key does not exist, this is a finding.

Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server.
 
Navigate to:
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0

Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys.
 
If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT III.

Implementation Procedure

Fix Text

Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure there is a recent backup of the system and registry settings.

Access the SQL Server.
Access an administrator command prompt. 
Type "regedit" to launch the Registry Editor.
 
Enable TLS 1.2:
  
1. Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
    a. If the "TLS 1.2" key does not exist, right-click "Protocols".
    b. Click "New".
    c. Click "Key".
    d. Type the name "TLS 1.2".

2. Navigate to the "TLS 1.2" subkey.
    a. If the subkey "Client" does not exist, right-click "TLS 1.2".
    b. Click "New".
    c. Click "Key".
    d. Type the name "Client".
    e. Repeat steps A-D for the "Server" subkey.

3. Navigate to the "Client" subkey.
    a. If the value "Enabled" does not exist, right-click on "Client".
    b. Click "New".
    c. Click "DWORD".
    d. Enter "Enabled" as the name.
    e. Repeat steps A-D for the value "DisabledByDefault".

4. Double-click "Enabled".

5. In Value Data, enter "1".

6. Click "OK".

7. Double-click "DisabledByDefault".

8. In Value Data, enter "0".

9. Click "OK".

10. Repeat steps 3-9 for the "Server" subkey.
 
Disable unwanted SSL/TLS protocol versions:

1. Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
    a. If the "TLS 1.0" key does not exist, right-click "Protocols".
    b. Click "New".
    c. Click "Key".
    d. Type the name "TLS 1.0".

2. Navigate to the "TLS 1.0" subkey.
    a. If the subkey "Client" does not exist, right-click "TLS 1.0".
    b. Click "New".
    c. Click "Key".
    d. Type the name "Client".
    e. Repeat steps A-D for the "Server" subkey.

3. Navigate to the "Client" subkey.
   a. If the value "Enabled" does not exist, right-click on "Client".
   b. Click "New".
   c. Click "DWORD".
   d. Enter "Enabled" as the name.
   e. Repeat steps A-D for the value "DisabledByDefault".

4. Double-click "Enabled".

5. In Value Data, enter "0".

6. Click "OK".

7. Double-click "DisabledByDefault".

8. In Value Data, enter "1".

9. Click "OK".

10. Repeat steps 3-9 for the "Server" subkey.

11. Repeat steps 1-10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0".

STIG check 37 of 79 in the Microsoft SQL Server 2022 Instance STIG checklist

← Previous · V-271309If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.Next · V-271313 →When using command-line tools such as SQLCMD in a mixed-mode authentication environment, users must use a logon method that does not expose the password.