We’ve been busy updating our suite of sp_Check tools, but…we forgot to tell you about that. And by we I mean me, so this post from me is to rectify that issue.
Speaking of issues, we have added a bunch of new issues to check for in sp_CheckSecurity recently. Fabiano Amorim and Andreas Wolter have been doing great work writing about SQL Server security issues, and we have tried to keep up with their findings by including new checks in sp_CheckSecurity. We would HIGHLY recommend updating your copy of that tool if you haven’t done so recently.
We’ve also added checks to our other tools, as well as made some parameter changes. And we added a MATRIX.md file so you can see which checks are in which tools.
For a full list of features, here are the recent Release Notes. Note that the 3-digit numbers relate to the new CheckIDs. Enjoy!
sp_CheckAG
2026.9.1
- Formatting changes only.
2026.10.1
- New check: 380 Endpoint encryption (Medium), for an endpoint that uses RC4 or no encryption.
- Fix: the error log temporary tables are widened to avoid truncation errors.
sp_CheckBackup
2026.9.1
– New checks:
- 219 Backups not encrypted (Medium, SQL Server 2014 and later)
- 220 Backups written to a local drive (Medium)
– Both use a single read of the last 7 days of full backups from msdb.
2026.10.1
- Fix (certificate checks 210 and 212): COLLATE DATABASE_DEFAULT is now applied when building the certificate details text. This fixes “Cannot resolve collation conflict” (Msg 446) when msdb and the install database have different collations, for example on servers hosting SSRS databases.
- Fix: the error log temporary tables (#FailedBackups, #ErrorLog) are widened to avoid truncation errors.
sp_CheckHealth
2026.9.1
– New checks:
- 358 SPN registration failed (High)
- 375 SQLAgentOperatorRole membership (High)
- 378 Always Encrypted column master key on database server (High)
- 633 Default trace disabled (High)
2026.10.1
- Result sets: at the default @Mode = 99 it now returns two result sets, instance information followed by problem findings.
- Header row: the CheckID 0 header row is in the findings set, not the instance information.
- Other modes: @Mode = 1 returns instance information only, @Mode = 0 returns findings only, and @Mode = 11 is unchanged.
– Fixes:
- The error log temporary tables are widened (ProcessInfo nvarchar(255), text nvarchar(max), LogDate datetime2), which fixes Msg 8152 on long log lines.
- CheckID 720 no longer raises the “Null value is eliminated by an aggregate” warning, because the CASE expressions now have ELSE 0. Results are unchanged.
sp_CheckSecurity
2026.9.1
– New checks (Security):
- 357 NTLM authentication in use (Medium)
- 358 SPN registration failed (High)
- 359 Legacy password hash algorithm (High)
- 360 SQL authentication in use (Medium)
- 361 Guest user has CONNECT permission (Medium)
- 362 Contained database users (Medium)
- 363 Application roles detected (Medium)
- 364 Certificate or asymmetric key mapped login (Medium)
- 365 Server role membership with escalation path (High)
- 366 Custom server role with elevated permissions (High)
- 367 BUILTIN\Administrators exists as a login (Medium)
- 368 ALTER ANY SERVER AUDIT granted to login (High)
- 369 External scripts enabled (Medium)
- 370 ALTER SETTINGS granted to login (High)
- 371 Unsigned assembly with elevated permission set (High)
- 372 Assembly creation permission granted to login (High)
- 373 Trusted assembly registered (High)
- 374 Agent proxy accessible to non-sysadmin (High)
- 375 SQLAgentOperatorRole membership (High)
- 376 Logon trigger (Medium)
- 377 Extended stored procedure registered (Medium)
- 378 Always Encrypted column master key on database server (High)
- 379 SQL Server Audit not capturing security actions (Medium)
– New checks (other categories):
- 202 Backups without checksum (Medium)
- 219 Backups not encrypted (Medium, SQL Server 2014 and later)
- 220 Backups written to a local drive (Medium)
- 633 Default trace disabled (High)
– Changed checks:
- 354 is now “Server-level permissions granted to login”. It covers ALTER ANY LOGIN, IMPERSONATE ANY LOGIN, ALTER ANY SERVER ROLE, ALTER ANY CREDENTIAL and ALTER ANY LINKED SERVER.
- 355 was “ALTER ANY LOGIN permissions”. It is now “Orphaned database user with elevated permissions” (High).
- 309 (CLR enabled) is now High. On SQL Server 2017 and later it flags CLR enabled with clr strict security off, even when SSISDB exists. On 2016 and earlier it still excludes servers with SSISDB.
- Modes: @Mode = 1 is now instance information only, and the new @Mode = 2 returns High-importance items only. Modes 0 and 99 are unchanged in meaning.
- Output: the Importance column is now numeric (0 to 3) rather than text like “1 – High”. Instance information labels no longer have leading spaces.
2026.10.1
- New check: 380 Endpoint encryption (Medium). It flags a database mirroring endpoint using RC4 or no encryption, including mixed AES RC4 settings.
- Instance information: the current state (Importance 0) of ten settings now appears: 310, 311, 319, 341, 342, 343, 345, 347, 348, 349.
- Issues: those ten now appear as findings only when enabled, except 310 (remote admin connections), which appears only when disabled. Their importance is unchanged.
- Registry reads: the Hide Instance, Extended Protection and Force Encryption reads happen once, and the Extended Protection read now uses @no_output.
- Fix: the error log temporary tables are widened (ProcessInfo nvarchar(255), text nvarchar(max), LogDate datetime2). That avoids “String or binary data would be truncated” on long log lines.
sp_CheckTempdb
2026.9.1
- Formatting changes only.
2026.10.1
- New check: 743 Large version store (Medium, High at 50% or more). It names the oldest open snapshot transaction when one exists.
- New parameter: @VersionStorePercent, default 25, with a 1 GB minimum reserved, clamped to 100.