diff --git a/plugins/generic/enumeration.py b/plugins/generic/enumeration.py
index 894ebbff8..ad740acd6 100644
--- a/plugins/generic/enumeration.py
+++ b/plugins/generic/enumeration.py
@@ -1147,7 +1147,7 @@ class Enumeration:
             lengths = {}
             entries = {}
 
-            if kb.dbms == "Oracle":
+            if kb.dbms in ("Oracle", "Microsoft SQL Server", "Sybase"):
                 plusOne = True
             else:
                 plusOne = False
@@ -1169,7 +1169,7 @@ class Enumeration:
                                                                conf.tbl.upper(),
                                                                index)
                     elif kb.dbms in ("Microsoft SQL Server", "Sybase"):
-                        query = rootQuery.blind.query % (column, index + 1, conf.db,
+                        query = rootQuery.blind.query % (column, index, conf.db,
                                                                conf.tbl, colList[0],
                                                                colList[0], colList[0])
 
diff --git a/xml/queries.xml b/xml/queries.xml
index 4a1d3e274..9a6fa34ac 100644
--- a/xml/queries.xml
+++ b/xml/queries.xml
@@ -458,7 +458,7 @@
         <is_dba query="PATINDEX('%sa_role%', SHOW_ROLE())>0"/>
         <users>
             <inband query="SELECT name FROM master..syslogins ORDER BY 1"/>
-            <blind query="SELECT TOP 1 name FROM master..syslogins WHERE name NOT IN (SELECT TOP %d name FROM master..syslogins)"count="SELECT LTRIM(STR(COUNT(name))) FROM master..syslogins"/>
+            <blind query="SELECT TOP 1 name FROM master..syslogins WHERE name NOT IN (SELECT TOP %d name FROM master..syslogins)" count="SELECT LTRIM(STR(COUNT(name))) FROM master..syslogins"/>
         </users>
         <passwords>
             <inband query="SELECT name, password FROM master..syslogins" condition="name"/>