What’s the issue?
The Hide Instance setting is a SQL Server network configuration option that prevents the SQL Server Browser service from exposing the instance to client “browse/enumeration” requests (for example, when users click Browse to discover SQL Servers).When enabled, the instance typically does not appear in enumerated lists returned by discovery tools, and clients must connect using the normal endpoint details rather than relying on Browser-based discovery; for hidden named instances this generally means specifying the port number (and using a static port is recommended).
The setting is configured in SQL Server Configuration Manager under the protocols for the affected instance, on the Flags tab. It is sometimes enabled deliberately as a hardening step to reduce casual discovery of SQL Server instances on the network, but it does not prevent access if an attacker already knows the endpoint details.
This finding identifies instances where Hide Instance is enabled. This is not necessarily a problem, but it’s worth noting in case the team is unaware the setting is active or unaware of the potential client connectivity implications (especially for named instances).
Why is this a problem?
Hide Instance provides modest security benefit by removing the instance from automated enumeration responses. An attacker scanning for SQL Server instances using browser-based discovery will not see the hidden instance in the response, which raises the bar slightly for opportunistic discovery. The protection is limited because port scanning, DNS enumeration, and other techniques can still find the instance, but the feature does eliminate one of the simpler discovery paths.The main client compatibility impact is for named instances, especially those using dynamic ports. Clients that rely on SQL Server Browser to resolve ServerInstance to the current TCP port will no longer be able to do so for a hidden instance. In these cases, clients must specify an explicit port (for example Server,Port) or use an alias, and configuring the instance to a static port is the common remediation.
Named instances are particularly affected. By default, named instances listen on dynamic ports that change at startup, and the SQL Server Browser service is what tells clients which port to use for a given instance name. With Hide Instance enabled, clients cannot resolve the dynamic port through the browser and must connect using a server name plus an explicit port number. The standard remediation is to configure the named instance to listen on a static port and document the port for client teams.
Hide Instance is also sometimes enabled in environments where the team is not aware of the implications, often as a side effect of applying a security hardening template. The condition is worth reviewing to confirm the feature is being used deliberately and that the supporting client connectivity model has been adjusted to work with hidden instances.
What should you do about this?
No remediation is required if Hide Instance is being used intentionally and the team is aware of the implications for client connectivity. Confirm the current setting in SQL Server Configuration Manager, and verify that clients—particularly for named instances—are connecting successfully using the appropriate endpoint details (often an explicit port or alias when Browser-based resolution isn’t available).For named instances with Hide Instance enabled, configure the instance to listen on a static port rather than a dynamic port, and document the port for client teams. Static port assignment is configured in SQL Server Configuration Manager under the IP Addresses tab of the TCP/IP protocol properties. Restart the SQL Server service after changing the port configuration so the new port takes effect.
Update connection strings and client configurations to use explicit endpoint details (for example, a server name plus an explicit port, or a SQL alias) rather than relying on SQL Server Browser to resolve instance names to dynamic ports. Test connectivity from each affected client environment to confirm the updated connection method works.
If Hide Instance was enabled inadvertently or has produced connectivity issues that outweigh the modest security benefit, disable it through SQL Server Configuration Manager. The change takes effect immediately for new connections. Disabling Hide Instance mainly restores Browser-based discoverability; it does not inherently change authentication requirements but can make the instance easier to enumerate.