SQL Server must initiate session auditing upon startup.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-271273	SRG-APP-000092-DB-000208	SQLI-22-004700	SV-271273r1109234_rule	2025-05-30	1

Description
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.

ℹ️ Check
When audits are enabled, they start up when the instance starts. Refer to https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 Check if an audit is configured and enabled by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

ℹ️ Check

When audits are enabled, they start up when the instance starts. Refer to https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 Check if an audit is configured and enabled by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

✔️ Fix
Configure the SQL audit(s) to automatically start during system startup. ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON Execute the following: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED' Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.