How to find who has changed the SQL Server service account

Question

How to find who has changed the SQL Server service account

SQL_Hunt

SSC-Dedicated

Points: 33518
More actions
January 4, 2018 at 3:15 pm

#342278

Hi,
How to find who has changed the SQL Server service account to run? Tried to find in eventvwr/sql errorlog but unable to get any trace.
Kindly advise if anyone has any advise on this?
Thanks.

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 1

Not sure, but if you are looking for something after the fact, you are probably out of luck.

For the future, you may have to look at what can of auditing you need to implement to capture those changes. I can't help you there.

RandomStream Hall of Fame Points: 3735 More actions · Answer 2

An ounce of prevention is worth (I forgot the rest).
We have security cameras in the server room just to keep an eye on things like this.

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 3

RandomStream - Thursday, January 4, 2018 4:54 PM
An ounce of prevention is worth (I forgot the rest).
We have security cameras in the server room just to keep an eye on things like this.

Do you also prevent admins from being able to RDP into the servers or to manage the servers remotely so they don't have to go into the server room except when they really need to physically touch the servers?

Super Cat SSCertifiable Points: 7334 More actions · Answer 4

Would windows Event Viewer shed any light as it is a windows task and would require a restart of the service.

Jeff Moden SSC Guru Points: 1004410 More actions · Answer 5

RandomStream - Thursday, January 4, 2018 4:54 PM
An ounce of prevention is worth (I forgot the rest).
We have security cameras in the server room just to keep an eye on things like this.

"Pound of cure"

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Ed Wagner SSC Guru Points: 287026 More actions · Answer 6

Like Super Cat suggested, it's a Windows change, so check the System event log. Your domain administrator might be of help here.

Tally Tables - Performance Personified
String Splitting with True Performance
Best practices on how to ask questions