search

NetSPI / PowerUpSQL

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
Other
2.47k stars 462 forks source link

False positives for "Excessive Privilege - Database Ownership Chaining" #50

Closed TVqQAAMA closed 2 years ago

TVqQAAMA commented 5 years ago

Invoke-SQLAudit flags false positives for "Excessive Privilege - Database Ownership Chaining" for the following databases

According to https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-database-transact-sql-set-options?view=sql-server-2017, the DB_CHAINING option cannot be set on the master, model, and tempdb system databases.

Another reference here which says these three system databases require cross-database ownership chaining to be turned on.

nullbind commented 5 years ago

Thanks for taking the time to reach out. I’ll take a look at the links you’ve provided.