V-271389
SV-271389r1109133_rule
CAT II
SQL Server must configure Customer Feedback and Error Reporting.
From: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide (V1R4)
Description
<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
Review the values for CustomerFeedback and EnableErrorReporting.
Option 1:
Launch "Registry Editor"
Navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE
Review the following values: CustomerFeedback, EnableErrorReporting
Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\160
Review the following values: CustomerFeedback, EnableErrorReporting
Option 2:
Run the PowerShell commands:
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Microsoft SQL Server\<SqlInstanceId>\CPE"
Get-ItemProperty -Path "HKLM:\ Software\Microsoft\Microsoft SQL Server\160"
Review the following values: CustomerFeedback, EnableErrorReporting
If this is a classified system, and any of the above values are not "0", this is a finding.
If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized.
If CEIP participation is not authorized, and any of the above values are "1", this is a finding.
Fix Text
To disable participation in the CEIP program, change the value of the following registry keys to "0".
To enable participation in the CEIP program, change the value of the following registry keys to "1".
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\160\CustomerFeedback
HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\160\EnableErrorReporting
Or in PowerShell, run:
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE" -Name CustomerFeedback -Value 0
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE" -Name EnableErrorReporting -Value 0
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Microsoft SQL Server\160" -Name CustomerFeedback -Value 0
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Microsoft SQL Server\160" -Name EnableErrorReporting -Value 0
CCI Reference
CCI-000366- Created
- 2026-04-07 20:08:24
- Last Updated
- 2026-04-07 20:08:24