Mixed-mode authentication permits both Windows authentication and SQL Server authentication through password-based SQL logins. It is often necessary when applications cannot use Windows authentication, but it also enables the well-known sa account. section 14.2
Avoid treating the installation choice as the security configuration:
- Windows authentication restricts access to Windows principals; installation must add at least one Windows user or group to sysadmin. section 14.2
- Mixed mode enables SQL logins with passwords and activates sa, giving attackers a known name with full administrative permissions to target. section 14.2
- Use mixed mode only where SQL authentication is required, then disable sa or rename it and enforce password policy and expiration. section 14.2
The unattended-installation trap
A scripted setup that passes /SECURITYMODE SQL must also supply an sa password. Immediately after installation, sa retains its default name, so the script should continue with hardening rather than treating setup completion as security completion. section 8.8
Listing 14.3 Disabling the sa account
ALTER LOGIN sa DISABLE ;
Disable the well-known administrator login with ALTER LOGIN sa DISABLE after ensuring other security principals can administer the instance. section 14.2
Listing 14.4 Renaming the sa account
ALTER LOGIN sa WITH NAME = InstanceAdmin ;
If sa must remain usable, rename it to a novel administrator name; apply password policy and expiration settings to the renamed login. section 14.2 section 8.8
