{"id":112014,"date":"2026-09-25T12:00:00","date_gmt":"2026-09-25T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=112014"},"modified":"2026-09-09T08:41:39","modified_gmt":"2026-09-09T08:41:39","slug":"how-to-close-sql-server-operational-blind-spots-linked-servers-dmvs-and-kill-command-security-risks-fixes","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/how-to-close-sql-server-operational-blind-spots-linked-servers-dmvs-and-kill-command-security-risks-fixes\/","title":{"rendered":"How to close SQL Server operational blind spots (linked servers, DMVs, and KILL command security risks &amp; fixes)"},"content":{"rendered":"\n<p id=\"h-\"><strong>The <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/\" target=\"_blank\" rel=\"noreferrer noopener\">SQL Server<\/a> attack pattern is consistent:<\/strong> <strong>attackers <em>do not<\/em> always need a spectacular vulnerability<\/strong>. They often succeed by chaining normal features that were granted too broadly, trusted too much, or&nbsp;monitored&nbsp;too narrowly.&nbsp;<\/p>\n\n\n\n<p>In this article, I&#8217;ll focus on operational blind spots in SQL Server. These are the features DBAs use every day to keep SQL Server healthy: <a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/relational-databases\/linked-servers\/linked-servers-database-engine?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\">linked servers<\/a>, traces, <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/database-administration-sql-server\/baselining-with-sql-server-dynamic-management-views\/\" target=\"_blank\" rel=\"noreferrer noopener\">Dynamic Management Views<\/a>, <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/database-administration-sql-server\/extended-events-data-collection\/\" target=\"_blank\" rel=\"noreferrer noopener\">Extended Events<\/a>, and session-management commands such as <code><a href=\"https:\/\/www.red-gate.com\/simple-talk\/other\/database-kill-and-fill\/\" target=\"_blank\" rel=\"noreferrer noopener\">KILL<\/a><\/code>. <\/p>\n\n\n\n<p>These tools, while necessary, also create visibility, automation, and trust paths that attackers can abuse after compromising a low-privileged application account or a local database owner.&nbsp;<\/p>\n\n\n\n<p><strong>Because of this, a SQL Server DBA should know the answer to the following questions at all times: where am I exposed, what should I&nbsp;monitor, and what should I change first?&nbsp;In this article, you&#8217;ll learn the answers to all three.<\/strong><\/p>\n\n\n\n<p><em>This article is part of <a href=\"https:\/\/www.red-gate.com\/simple-talk\/collections\/fabiano-amorims-complete-guide-to-sql-server-security\/\" target=\"_blank\" rel=\"noreferrer noopener\">Fabiano Amorim&#8217;s complete guide to SQL Server security<\/a> on Simple Talk.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-why-it-s-so-important-to-cover-any-operational-blind-spots-in-sql-server\">Why it&#8217;s so important to cover any operational blind spots in SQL Server<\/h2>\n\n\n\n<p>Operational features are attractive targets because they already run inside the trusted perimeter. It could be a nightly <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/database-administration-sql-server\/rebuilding-indexes-using-the-ssms-database-maintenance-wizard\/\" target=\"_blank\" rel=\"noreferrer noopener\">index&nbsp;rebuild<\/a>,&nbsp;a replication cleanup process, or a cross-server reporting query, for example. It could even be a <a href=\"https:\/\/www.red-gate.com\/products\/redgate-monitor\/\" target=\"_blank\" rel=\"noreferrer noopener\">monitoring<\/a> job running with <em>far<\/em> more privilege than the user database being touched.<\/p>\n\n\n\n<p>Put simply: <strong>if a lower-privileged SQL Server user can influence the object, data, or metadata that a privileged process later consumes, the attacker does not need to directly hold the privileged credential. They just need to leave a trap for the trusted process.&nbsp;<\/strong><\/p>\n\n\n\n<p>This is why DBA monitoring must always stretch beyond simple perimeter controls and patch status. It should also include who can&nbsp;create or&nbsp;touch user-controlled objects, how linked servers authenticate remote queries, who can see query text and diagnostic metadata, and who can&nbsp;terminate&nbsp;sessions.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-linked-servers-and-cross-instance-trust-nbsp-in-sql-server\">Linked servers and cross-instance trust&nbsp;in SQL Server<\/h2>\n\n\n\n<p>Linked servers are often introduced for legitimate reasons such as reporting, <a href=\"https:\/\/www.red-gate.com\/simple-talk\/collections\/migrating-from-on-prem-to-the-cloud-dba-stories\/\" target=\"_blank\" rel=\"noreferrer noopener\">migrations<\/a>, <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/data-warehouse-load-patterns\/\" target=\"_blank\" rel=\"noreferrer noopener\">data warehouse loads<\/a>, vendor integrations, or legacy applications. From a security perspective, a linked server expands the security boundary of the local SQL Server instance to include the remote data source and the credential mapping used to reach it.&nbsp;<\/p>\n\n\n\n<p><strong>The most common linked server exposure is a permissive login mapping<\/strong>. If all local logins are mapped to a single remote credential, a low-privileged local account may inherit far more privilege on the remote server than it has locally. If <code>RPC OUT<\/code> is enabled, the exposure can move from data access to remote procedure execution.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-a-practical-example-of-this\">A practical example of this<\/h3>\n\n\n\n<p>A front-end application database has a linked server to a reporting or finance instance. To simplify deployment, the linked server is&nbsp;configured&nbsp;so any&nbsp;local login&nbsp;not explicitly mapped connects to the remote server using one shared remote account. <\/p>\n\n\n\n<p>A compromised application login can now query the linked server and&nbsp;operate&nbsp;on the remote system using that shared credential. The attacker did not compromise the remote login directly; the linked server handed it to them through a trust mapping.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-what-are-the-signs-a-dba-should-look-for\">What are the signs a DBA should look for?<\/h3>\n\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Linked servers with a fallback mapping that uses a shared remote account for all undefined local logins.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Remote login mappings that use highly privileged accounts such as <code>sysadmin<\/code>,&nbsp;<code>db_owner<\/code>, deployment accounts, or vendor admin accounts.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><code>RPC OUT<\/code> is&nbsp;enabled&nbsp;when the business requirement is read-only reporting or&nbsp;simple&nbsp;distributed <code>SELECT<\/code> queries.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Loopback linked servers (especially when they are used to bypass context, transaction, or permission assumptions.)<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Linked servers with no known owner, no documented business purpose, or no recent telemetry showing authorized use.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Linked servers reachable from databases exposed to web applications, <a href=\"https:\/\/en.wikipedia.org\/wiki\/Extract,_transform,_load\" target=\"_blank\" rel=\"noreferrer noopener\">ETL (extract-transform-load)<\/a> users, report users, or broad support groups.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-what-to-nbsp-monitor-nbsp-and-how-nbsp\">What to&nbsp;monitor&nbsp;&#8211; and how&nbsp;<\/h3>\n\n\n\n<p><strong>Review all linked servers, options, and security mappings regularly.<\/strong> The following queries highlight the most important properties for a DBA to review:<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">\/* Linked server options *\/ \nSELECT \n    name AS LinkedServerName, \n    product, \n    provider, \n    data_source, \n    is_linked, \n    is_data_access_enabled, \n    is_rpc_out_enabled, \n    is_remote_login_enabled, \n    is_remote_proc_transaction_promotion_enabled \nFROM sys.servers \nWHERE is_linked = 1 \nORDER BY name; \n \n\/* Linked server login mappings *\/ \nSELECT \n    s.name AS LinkedServerName, \n    COALESCE(sp.name, '&lt;all local logins \/ fallback&gt;') AS LocalPrincipal, \n    ll.uses_self_credential, \n    ll.remote_name \nFROM sys.linked_logins AS ll \nJOIN sys.servers AS s \n    ON ll.server_id = s.server_id \nLEFT JOIN sys.server_principals AS sp \n    ON ll.local_principal_id = sp.principal_id \nWHERE s.is_linked = 1 \nORDER BY s.name, LocalPrincipal; <\/pre><\/div>\n\n\n\n<p><strong>Look for local principals that can alter linked servers or server objects.<\/strong> These permissions should be limited to DBAs or controlled deployment automation.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">SELECT \n    pr.name AS PrincipalName, \n    pr.type_desc AS PrincipalType, \n    pe.state_desc, \n    pe.permission_name, \n    pe.class_desc \nFROM sys.server_permissions AS pe \nJOIN sys.server_principals AS pr \n    ON pe.grantee_principal_id = pr.principal_id \nWHERE pe.permission_name IN \n    ('ALTER ANY LINKED SERVER', 'ALTER ANY LOGIN', 'ALTER ANY CREDENTIAL', \n     'ALTER SETTINGS', 'CONTROL SERVER') \nORDER BY pr.name, pe.permission_name; <\/pre><\/div>\n\n\n\n<p><strong>Audit linked server configuration changes using server-level audit groups.<\/strong> Also&nbsp;monitor&nbsp;for distributed-query usage from unexpected logins or applications.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">\/* Example audit specification for server object and permission changes *\/ \nCREATE SERVER AUDIT SPECIFICATION [Audit_LinkedServer_Config] \nFOR SERVER AUDIT [Your_Server_Audit] \n    ADD (SERVER_OBJECT_CHANGE_GROUP), \n    ADD (SERVER_PERMISSION_CHANGE_GROUP), \n    ADD (SERVER_PRINCIPAL_CHANGE_GROUP) \nWITH (STATE = ON); \nGO <\/pre><\/div>\n\n\n\n<p><strong>For runtime monitoring, use Extended Events or your existing monitoring platform to&nbsp;watch for&nbsp;distributed query patterns.<\/strong> Keep filters tight; capturing every statement on a busy system can be expensive.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">CREATE EVENT SESSION [Monitor_LinkedServer_Usage] ON SERVER \nADD EVENT sqlserver.sql_statement_completed( \n    ACTION(sqlserver.client_app_name, sqlserver.database_name, \n           sqlserver.server_principal_name, sqlserver.sql_text) \n    WHERE (sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%OPENQUERY%') \n        OR sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%OPENROWSET%') \n        OR sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%EXEC% AT %'))) \nADD TARGET package0.event_file \n    (SET filename = N'D:\\XEvents\\Monitor_LinkedServer_Usage.xel', max_file_size = 50, max_rollover_files = 5) \nWITH (STARTUP_STATE = OFF); \nGO <\/pre><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-recommended-fixes-and-mitigations-nbsp\">Recommended fixes and mitigations&nbsp;<\/h3>\n\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Avoid <a href=\"https:\/\/nhimg.org\/glossary\/fallback-mapping\/\" target=\"_blank\" rel=\"noreferrer noopener\">fallback mappings<\/a> that allow all local logins to connect using one shared remote credential. Configure the fallback&nbsp;behavior&nbsp;so connections are not made unless explicitly mapped.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Use explicit local-to-remote mappings with&nbsp;least&nbsp;privilege. For reporting, the remote login should usually be read-only and restricted to the required database, schema, or views.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Disable <code>RPC OUT<\/code> unless there&#8217;s a documented requirement to <a href=\"https:\/\/blog.sqlauthority.com\/2007\/10\/06\/sql-server-executing-remote-stored-procedure-calling-stored-procedure-on-linked-server\/\" target=\"_blank\" rel=\"noreferrer noopener\">execute remote stored procedures<\/a>. If only distributed <code>SELECT<\/code> is&nbsp;required, <code>RPC OUT<\/code> should be <em>off<\/em>.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Remove unused linked servers. Legacy links are high-risk because they often&nbsp;retain&nbsp;old credentials, broad mappings, and don&#8217;t have an active owner.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Separate application-facing instances from administrative&nbsp;linked-server&nbsp;paths. A compromised web or report login should never have a bridge into finance, payroll, or operational administration servers.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Review delegation and <a href=\"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/database-administration-sql-server\/questions-about-kerberos-and-sql-server-that-you-were-too-shy-to-ask\/\" target=\"_blank\" rel=\"noreferrer noopener\">Kerberos<\/a> double-hop settings carefully.&nbsp;Delegation problems often lead teams to hardcode shared credentials, which increases risk.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Test linked server access with low-privileged accounts. Do not&nbsp;validate&nbsp;only with <code>sysadmin<\/code> sessions.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n\n<section id=\"my-first-block-block_55a3be0936cab3aa4941e70242ad09da\" class=\"my-first-block alignwide\">\n    <div class=\"bg-brand-600 text-base-white py-5xl px-4xl rounded-sm bg-gradient-to-r from-brand-600 to-brand-500 red\">\n        <div class=\"gap-4xl items-start md:items-center flex flex-col md:flex-row justify-between\">\n            <div class=\"flex-1 col-span-10 lg:col-span-7\">\n                <h3 class=\"mt-0 font-display mb-2 text-display-sm\">Future-proof database monitoring with Redgate Monitor<\/h3>\n                <div class=\"child:last-of-type:mb-0\">\n                                            Multi-platform database observability for your entire estate. Optimize performance, ensure security, and mitigate potential risks with fast deep-dive analysis, intelligent alerting, and AI-powered insights.                                    <\/div>\n            <\/div>\n                                            <a href=\"https:\/\/www.red-gate.com\/products\/redgate-monitor\/\" class=\"btn btn--secondary btn--lg\" aria-label=\"Learn more &amp; try for free: Future-proof database monitoring with Redgate Monitor\">Learn more &amp; try for free<\/a>\n                    <\/div>\n    <\/div>\n<\/section>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-sql-server-traces-dmvs-extended-events-and-the-kill-command\">SQL Server Traces, DMVs, Extended Events, and the <code>KILL<\/code> command<\/h2>\n\n\n\n<p><strong>Observability is essential for SQL Server performance tuning, troubleshooting, auditing, and incident response. It&#8217;s also a reconnaissance surface. <\/strong><\/p>\n\n\n\n<p>Traces, Extended Events, DMVs, query text, execution plans, error messages, session metadata, file paths, and Agent activity can reveal how the environment is built, and how security controls are implemented.&nbsp;<\/p>\n\n\n\n<p>Operational metadata can be very useful for an attacker. For example, query text from monitoring jobs may reveal which accounts are whitelisted, which procedures perform administrative work, which jobs run with elevated context, which linked servers exist, and which object names matter. <\/p>\n\n\n\n<p>A user who can see too much may not yet be privileged &#8211; but they may already have enough information to plan a targeted privilege escalation.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-a-practical-example-of-this-0\">A practical example of this<\/h3>\n\n\n\n<p>A monitoring job checks for unexpected <code>sysadmin<\/code> members by comparing current role membership against an approved list. If a low-privileged user can see the running query text through DMVs, traces, or Extended Events output, that user learns <em>exactly which<\/em> privileged names the monitoring process treats as normal. <\/p>\n\n\n\n<p>That information is dangerous &#8211; it can help them choose a stealthier target, abuse an existing trusted account, or understand where detection rules are weak.<\/p>\n\n\n\n<p>Similarly, broad permission to&nbsp;terminate&nbsp;sessions is often underestimated. In SQL Server, <code>KILL<\/code>&nbsp;requires&nbsp;<code>ALTER ANY CONNECTION<\/code>, which is included in powerful roles such as <code>sysadmin<\/code> and&nbsp;<code>processadmin<\/code>. Granting this ability to&nbsp;general support&nbsp;or application accounts can create <a href=\"https:\/\/en.wikipedia.org\/wiki\/Denial-of-service_attack\" target=\"_blank\" rel=\"noreferrer noopener\">denial-of-service (DoS)<\/a> and incident-response interference risks.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-what-are-the-signs-a-dba-should-look-for-0\">What are the signs a DBA should look for?<\/h3>\n\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Non-administrative logins with <code>VIEW SERVER STATE<\/code>, <code>VIEW SERVER PERFORMANCE STATE<\/code>, <code>VIEW SERVER SECURITY STATE<\/code>, <code>VIEW ANY DEFINITION<\/code>, <code>ALTER ANY EVENT SESSION<\/code>, <code>ALTER TRACE<\/code>, or <code>ALTER ANY CONNECTION<\/code>.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Application accounts, vendor accounts, or reporting users that query\u00a0<code>sys.dm_exec_requests<\/code>,\u00a0<code>sys.dm_exec_sessions<\/code>,\u00a0<code>sys.dm_exec_sql_text<\/code>,\u00a0<code>sys.dm_exec_query_stats<\/code>,<br><code>sys.traces<\/code>, or\u00a0<code>fn_trace_gettable<\/code>.\u00a0<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Users who can read trace or Extended Events files from the file system or from a shared monitoring repository.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Monitoring jobs whose SQL text exposes detection allow-lists, privileged account names, internal procedure names, secrets, file paths, or operational assumptions.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Repeated conversion errors, metadata permission errors, invalid object errors, or access-denied errors against system views from low-privileged sessions.&nbsp;<br><\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Support tools that require <code>KILL<\/code> privileges to manage blocking rather than using a controlled DBA process.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-what-to-nbsp-monitor-nbsp-and-how-nbsp-0\">What to&nbsp;monitor&nbsp;&#8211; and how&nbsp;<\/h3>\n\n\n\n<p><strong>Start by reviewing broad server-level permissions.<\/strong> SQL Server 2022 introduced more granular <code>VIEW SERVER PERFORMANCE STATE<\/code> and <code>VIEW SERVER SECURITY STATE<\/code> permissions for some DMV scenarios, so review the exact version and minimum permission needed.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">SELECT \n    pr.name AS PrincipalName, \n    pr.type_desc AS PrincipalType, \n    pe.state_desc, \n    pe.permission_name, \n    pe.class_desc \nFROM sys.server_permissions AS pe \nJOIN sys.server_principals AS pr \n    ON pe.grantee_principal_id = pr.principal_id \nWHERE pe.permission_name IN \n    ('VIEW SERVER STATE', 'VIEW SERVER PERFORMANCE STATE', \n     'VIEW SERVER SECURITY STATE', 'VIEW ANY DEFINITION', \n     'ALTER TRACE', 'ALTER ANY EVENT SESSION', 'ALTER ANY CONNECTION') \nORDER BY pr.name, pe.permission_name; <\/pre><\/div>\n\n\n\n<p>Also <strong>review membership in server-level roles<\/strong> that imply visibility or session-control capabilities:<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">SELECT \n    role_principal.name AS ServerRole, \n    member_principal.name AS MemberName, \n    member_principal.type_desc AS MemberType \nFROM sys.server_role_members AS rm \nJOIN sys.server_principals AS role_principal \n    ON rm.role_principal_id = role_principal.principal_id \nJOIN sys.server_principals AS member_principal \n    ON rm.member_principal_id = member_principal.principal_id \nWHERE role_principal.name IN ('sysadmin', 'securityadmin', 'serveradmin', 'processadmin') \nORDER BY role_principal.name, member_principal.name; <\/pre><\/div>\n\n\n\n<p><strong>If the default trace is enabled, review who can access trace output<\/strong> &#8211; and whether the trace files are exposed through file shares, backup tooling, or diagnostic exports:<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">SELECT name, value_in_use \nFROM sys.configurations \nWHERE name = 'default trace enabled'; \n \nSELECT * \nFROM sys.traces; <\/pre><\/div>\n\n\n\n<p><strong>Use Extended Events to detect metadata probing patterns.<\/strong> Conversion failures, invalid object names, permission errors, and database-access errors are normal in small quantities, but repeated attempts by the same low-privileged login can&nbsp;indicate&nbsp;enumeration.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">CREATE EVENT SESSION [Monitor_Metadata_Probing] ON SERVER \nADD EVENT sqlserver.error_reported( \n    ACTION(sqlserver.client_app_name, sqlserver.database_name, \n           sqlserver.server_principal_name, sqlserver.sql_text, sqlserver.username) \n    WHERE ([severity] &gt;= 11 \n       AND [error_number] IN (207, 208, 229, 245, 257, 297, 916, 15151))) \nADD TARGET package0.event_file \n    (SET filename = N'D:\\XEvents\\Monitor_Metadata_Probing.xel', max_file_size = 50, max_rollover_files = 5) \nWITH (STARTUP_STATE = ON); \nGO \nALTER EVENT SESSION [Monitor_Metadata_Probing] ON SERVER STATE = START; \nGO <\/pre><\/div>\n\n\n\n<p><strong>Monitor <code>KILL<\/code> usage.<\/strong> SQL Audit and Extended Events can both help, but many teams implement a simple statement-capture rule for <code>KILL<\/code> statements and correlate it with ticket numbers, blocking alerts, or DBA incident channels:<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">CREATE EVENT SESSION [Monitor_KILL_Commands] ON SERVER \nADD EVENT sqlserver.sql_batch_completed( \n    ACTION(sqlserver.client_app_name, sqlserver.database_name, \n           sqlserver.server_principal_name, sqlserver.sql_text) \n    WHERE (sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'KILL %'))), \nADD EVENT sqlserver.sql_statement_completed( \n    ACTION(sqlserver.client_app_name, sqlserver.database_name, \n           sqlserver.server_principal_name, sqlserver.sql_text) \n    WHERE (sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'KILL %'))) \nADD TARGET package0.event_file \n    (SET filename = N'D:\\XEvents\\Monitor_KILL_Commands.xel', max_file_size = 25, max_rollover_files = 5); \nGO<\/pre><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-recommended-fixes-and-mitigations-nbsp-0\">Recommended fixes and mitigations&nbsp;<\/h3>\n\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Never broadly grant <code>VIEW SERVER STATE<\/code> just because a user needs one performance metric. Expose only the required information through a signed stored procedure, a controlled monitoring database, or a purpose-built view.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>For SQL Server 2022 and later, evaluate whether <code>VIEW SERVER PERFORMANCE STATE<\/code> or <code>VIEW SERVER SECURITY STATE<\/code> better matches the requirement instead of granting full <code>VIEW SERVER STATE<\/code>.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Restrict <code>ALTER ANY EVENT SESSION<\/code> and <code>ALTER TRACE<\/code> to trusted DBA automation and senior administrators. Event sessions can capture sensitive text and should be treated as privileged telemetry.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Treat <code>ALTER ANY CONNECTION<\/code> as a high-privilege operational permission. If support teams need to resolve blocking, route termination through a controlled process rather than granting <code>KILL<\/code> more broadly.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Reduce sensitive text in monitoring jobs. Avoid hardcoded secrets, full allow-lists, or internal security assumptions in query text that broad monitoring users can&nbsp;observe.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Protect trace and Extended Events files at the&nbsp;file-system&nbsp;level. SQL permissions are not enough if users can read the files from disk, backups, or shared diagnostic folders.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li>Review whether default trace is still&nbsp;required. In modern environments, replace broad trace use with purpose-built Extended Events sessions that capture only the required fields and have clear retention rules.&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-an-operational-checklist-for-dbas\">An operational checklist for DBAs<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Area<\/strong>&nbsp;<\/td><td><strong>Check<\/strong>&nbsp;<\/td><td><strong>Action<\/strong>&nbsp;<\/td><\/tr><tr><td>Linked servers&nbsp;<\/td><td>Inventory linked servers, login mappings, fallback mappings, and <code>RPC OUT<\/code>.&nbsp;<\/td><td>Remove unused links, disable <code>RPC OUT<\/code> wherever possible, and replace shared mappings with explicit least-privilege mappings.&nbsp;<\/td><\/tr><tr><td>Observability&nbsp;<\/td><td>Review <code>VIEW SERVER STATE<\/code>, <code>ALTER TRACE<\/code>, <code>ALTER ANY EVENT&nbsp;SESSION<\/code>, and file access to trace\/Extended Events outputs.&nbsp;<\/td><td>Expose only&nbsp;required&nbsp;diagnostics through controlled interfaces.&nbsp;<\/td><\/tr><tr><td><code>KILL<\/code>\/session control&nbsp;<\/td><td>Review <code>ALTER ANY CONNECTION<\/code> and&nbsp;<code>processadmin<\/code>&nbsp;membership.&nbsp;<\/td><td>Restrict session termination to DBAs or approved automation with logging.&nbsp;<\/td><\/tr><tr><td>Error probing&nbsp;<\/td><td>Monitor repeated metadata and conversion errors from low-privileged accounts.&nbsp;<\/td><td>Investigate patterns rather than isolated errors.&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion-nbsp\">Conclusion&nbsp;<\/h2>\n\n\n\n<p>Linked servers, traces, DMVs, Extended Events, and <code>KILL<\/code> are just part of normal operations in many SQL Server environments &#8211; and that&#8217;s exactly why they deserve a\u00a0security\u00a0review. Attackers prefer paths that look like normal administration because those paths are trusted, scheduled and often under-monitored.\u00a0<\/p>\n\n\n\n<p>The practical, defensive approach is to reduce hidden trust. Who can create triggers? Which jobs touch untrusted databases? How do linked servers authenticate? Who can see query text and diagnostic metadata &#8211; and who can terminate sessions? You need to know the answer to all of these.<\/p>\n\n\n\n<p>Then &#8211; once these relationships are visible &#8211; DBAs can apply least privilege, targeted auditing, and safe maintenance patterns without breaking the operational workflows the business depends on.\u00a0<\/p>\n\n\n\n<p>Instead of simply just disabling &#8216;dangerous&#8217; features,\u00a0you should be validating\u00a0the features you keep enabled &#8211; and proving that their trust boundaries are intentional.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-references-and-further-reading\">References and further reading\u00a0<\/h3>\n\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/relational-databases\/security\/auditing\/sql-server-audit-action-groups-and-actions?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\">SQL Server Audit action groups and actions<\/a>&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/relational-databases\/linked-servers\/create-linked-servers-sql-server-database-engine?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\">Create linked servers<\/a>&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/relational-databases\/system-stored-procedures\/sp-addlinkedserver-transact-sql?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\"><code>sp_addlinkedserver<\/code><\/a>\u00a0<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/relational-databases\/system-dynamic-management-views\/system-dynamic-management-views?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\">System dynamic management views<\/a>&nbsp;<\/li>\n<\/ul>\n<\/div>\n\n<div class=\"block-core-list\">\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/sql\/t-sql\/language-elements\/kill-transact-sql?view=sql-server-ver17\" target=\"_blank\" rel=\"noreferrer noopener\"><code>KILL<\/code> (Transact-SQL)<\/a>\u00a0<\/li>\n<\/ul>\n<\/div>\n\n\n<section id=\"my-first-block-block_d6fd6a1ebfd5d3dd73bf4e1d6c2d06f7\" class=\"my-first-block alignwide\">\n    <div class=\"bg-brand-600 text-base-white py-5xl px-4xl rounded-sm bg-gradient-to-r from-brand-600 to-brand-500 red\">\n        <div class=\"gap-4xl items-start md:items-center flex flex-col md:flex-row justify-between\">\n            <div class=\"flex-1 col-span-10 lg:col-span-7\">\n                <h3 class=\"mt-0 font-display mb-2 text-display-sm\">Protect your data. Demonstrate compliance.<\/h3>\n                <div class=\"child:last-of-type:mb-0\">\n                                            With Redgate, stay ahead of threats with real-time monitoring and alerts, protect sensitive data with automated discovery &#038; masking, and demonstrate compliance with traceability across every environment.                                    <\/div>\n            <\/div>\n                                            <a href=\"https:\/\/www.red-gate.com\/solutions\/use-cases\/security-and-compliance\/\" class=\"btn btn--secondary btn--lg\" aria-label=\"Learn more: Protect your data. Demonstrate compliance.\">Learn more<\/a>\n                    <\/div>\n    <\/div>\n<\/section>\n\n\n<section id=\"faq\" class=\"faq-block my-5xl\">\n    <h2>FAQs: How to close SQL Server operational blind spots (linked servers, DMVs, and KILL command security risks &amp; fixes)<\/h2>\n\n                        <h3 class=\"mt-4xl\">1. What is a SQL Server operational blind spot?<\/h3>\n            <div class=\"faq-answer\">\n                <p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">It&#8217;s a legitimate, necessary feature &#8211; like a linked server or a monitoring job &#8211; that&#8217;s configured too permissively or watched too loosely, letting a low-privileged attacker use it as a stepping stone to more privileged systems or data.<\/p>\n            <\/div>\n                    <h3 class=\"mt-4xl\">2. How can a linked server become a security risk?<\/h3>\n            <div class=\"faq-answer\">\n                <p>If a linked server maps all undefined local logins to one shared remote credential, a compromised low-privileged account can inherit much greater privilege on the remote server. The risk grows further if <code>RPC OUT<\/code> is enabled, since that allows remote procedure execution rather than just data access.<\/p>\n            <\/div>\n                    <h3 class=\"mt-4xl\">3. Why are DMVs and Extended Events considered a reconnaissance risk?<\/h3>\n            <div class=\"faq-answer\">\n                <p>DMVs, traces, and Extended Events can expose query text, privileged account names, internal procedure names, and monitoring logic. A user who can view this metadata may not be privileged yet, but they gain the information needed to plan a targeted escalation.<\/p>\n            <\/div>\n                    <h3 class=\"mt-4xl\">4. What permission does the KILL command require, and why does that matter?<\/h3>\n            <div class=\"faq-answer\">\n                <p><code>KILL<\/code> requires <code>ALTER ANY CONNECTION<\/code>, which is bundled into powerful roles like sysadmin and processadmin. Granting this broadly to support or application accounts creates denial-of-service risk and can interfere with incident response.<\/p>\n            <\/div>\n                    <h3 class=\"mt-4xl\">5. What&#039;s the fastest first step to reduce these risks?<\/h3>\n            <div class=\"faq-answer\">\n                <p>Review all linked servers and their login mappings, disable <code>RPC OUT<\/code> unless explicitly required, remove unused linked servers, and restrict <code>VIEW SERVER STATE<\/code>, <code>ALTER TRACE<\/code>, and <code>ALTER ANY CONNECTION<\/code> to trusted DBA accounts only.<\/p>\n            <\/div>\n            <\/section>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how attackers exploit SQL Server linked servers, traces, DMVs, and the KILL command &#8211; plus the monitoring queries and fixes DBAs need to close these blind spots.&hellip;<\/p>\n","protected":false},"author":65554,"featured_media":106674,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[143523,53,143530,46,143524,143531],"tags":[4168,4170,159408,5765,4150,4151,4252],"coauthors":[6809],"class_list":["post-112014","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-databases","category-featured","category-security","category-data-security-privacy-compliance","category-sql-server","category-t-sql-programming-sql-server","tag-database","tag-database-administration","tag-fasqlsecurity","tag-security-and-compliance","tag-sql","tag-sql-server","tag-t-sql-programming"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/users\/65554"}],"replies":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/comments?post=112014"}],"version-history":[{"count":11,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112014\/revisions"}],"predecessor-version":[{"id":112297,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112014\/revisions\/112297"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media\/106674"}],"wp:attachment":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media?parent=112014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/categories?post=112014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/tags?post=112014"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/coauthors?post=112014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}