How to findout who changed the sqlserver properties?
-
Hi,
Someone has changed the SQL Server properties.
Server Authentication is changed to ‘Windows Authentication Mode’ it should be ‘SQL Server and Windows Authentication Mode’.
How to findout who changed the sqlserver properties?
-
The logs have already wrapped around so we can’t see who logged in before .
-
i just changed it on my dev machine, and can find it in both the SQL logs and the Event Viewers "Security" Windows logs, but it's not obvious what the event was:
Lowell
--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible! -
Do you mean your Windows logs have wrapped? Likely you need to make them larger then, or setup a better auditing system.
-
If you don't have the auditing set up to keep this info, then there's really no way you can go back and find out who changed your server properties. Sorry. The best you can do is figure out who has access to all the security accounts (including the Windows Local Admin Group) and see if any of them will admit to the deed.
For future reference, though, you might consider setting up timed traces or DDL triggers or some other SQL event that records such things.
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply