14 votes
Accepted

Should I drop dbo from the database role db_owner?

Don't worry about it. In fact, you cannot drop dbo from db_owner. There's a hard-wired blocker in the engine prohibiting you to do so. Try and you get the error: Msg 15405, Level 16, State 1, Line 1 ...
7 votes

Should I drop dbo from the database role db_owner?

It sounds like the vulnerability audit tool you use just always flags whenever a User, is mapped to the db_owner role, which in this case is the default dbo. I believe there has to always be one ...
  • 26.4k
5 votes
Accepted

How can I run SQL Server Vulnerability Assessment from a SQL Job?

The articles referenced in @Kin Shah's answer helped me to come to a final solution. I had to switch from the "PowerShell" SQL Job Type to the "Operating system (CmdExec)" Type. I moved my PowerShell ...
  • 193
5 votes

How can I run SQL Server Vulnerability Assessment from a SQL Job?

You are getting that error because the module is not imported. You have to use import-module -name sqlserver # or path to the module see : Running PowerShell in a SQL Agent Job
  • 61.4k
2 votes

Incorrect "Sensitive data columns should be classified" report

Basically it will not fade away when we approve it as a baseline. Sometimes it does. But in most cases we will get baseline mismatch where we should go inside the database to classify those data that ...
2 votes

On what basis DMA identifies columns for Dynamic Data Masking?

From what I understand, DMA looks at the column names and tables for keywords that would hold PII, Sensitive Data (such as logins, passwords, etc.), or other unique data attributes. If it finds ...
1 vote
Accepted

Should I provide db_owner principal role to the user of the Azure SQL of my Azure Web App?

As you saw my answer and Tibor's to Should I drop dbo from the database role db_owner? you shouldn't be too concerned about the legacy dbo User. For your ACME User, I agree you should follow the least ...
  • 26.4k
1 vote

Trying to disable xp_Cmdshell and rpc_out and and receiving mixed results

Your security scanning software is likely identifying your system running sql server and highlighting this as a risk. There is no actual validation of a risk through code, just flagging it as a ...
  • 377
1 vote
Accepted

Incorrect "Sensitive data columns should be classified" report

You need to add those as a 'baseline', basically marking those items as ignorable items so that when the VA report runs again it ignores them. See here for more information.
  • 9,512

Only top scored, non community-wiki answers of a minimum length are eligible