A number of security benchmarks (e.g. CIS v1.0.0, FedRAMP, ..) those days we are recommending to disable Microsoft Sql Server features such as remote access, contained database authentication, cross db ownership chaining, allow updates, .. unless we actually have a real requirement for those features.
The rationale is that disabling those features, we would shrink the surface attack area.
A first step we can take is to get a report of which features are actually enabled in our database systems. The following query will do the deed (per instance):
What if we find out that some of those features affecting security is actually enabled?
Here is a query which will reconfigure all the databases in a given instance, disabling remote access, one of those features:.
Caveat: generally, don't use the above or similar scripts in Production, as long as you don't understand and accept the consequences.
Caveat: always read the message log.
Caveat: sp_MSforeachdb is undocumented, and AFAIK unsupported.
Caveat: the code above is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. in no event shall the author be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the code above.