Post reply

Thousands of Successful Logins

  • February 13, 2019 at 12:31 pm

    #409511

    We are seeing user accounts with tens thousands of successful logins per day.  These are SSMS users. This strikes me as odd but maybe it is this normal?

  • February 13, 2019 at 2:33 pm

    #2022013

    Are you auditing successful logins?

    Are you asking if these should not be from SSMS or if this is a large amount from SSMS? Every time you open a new query window, you'll make a new connection. There are some reconnect features in SSMS as well.

  • February 19, 2019 at 1:39 pm

    #2022427

    Thanks for responding.
    Yes, we're now auditing successful logins.  It's a security requirement.  
    Individual accounts are getting 50,000+ records in a 24 hour period.  These are SSMS sessions; looks like a heartbeat.

  • February 20, 2019 at 7:19 am

    #2022471

    rchantler - Tuesday, February 19, 2019 1:39 PM

    Thanks for responding.
    Yes, we're now auditing successful logins.  It's a security requirement.  
    Individual accounts are getting 50,000+ records in a 24 hour period.  These are SSMS sessions; looks like a heartbeat.

    You could use Profiler and trace just that login and see what SQL it is running.  That might better help identify what it is doing.

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply