RE: SQL Worm

From: David SheafferMS (dsheaff@onlinemicrosoft.com)
Date: 05/21/02 

From: dsheaff@onlinemicrosoft.com (David SheafferMS)
Date: Tue, 21 May 2002 14:56:35 GMT

Tim,
  You may want to enabling login auditing in SQL Server. You can audit
both successful and failed login attempts to SQL Server. To enable
auditing use Entperprise Manager, select the server and right mouse click
and choose Properties. Auditing can be enabled on the Security tab. You
will need to restart SQL Server for auditing to become effective.
  Also to identify the culprit process/workstation you can use the
following query:

select * from master..sysprocesses

Output will contain program name, host name, NT account etc which might
help in identifying the process.

dsheaff@onlinemicrosoft.com

This posting is provided 'AS IS' with no warranties, and confers no rights.

Relevant Pages

  • Re: Full Text Indexing on Microsoft SQL Server 2000 with Windows XP Pro
    ... I went in there and I found the Auditing level set to None which ... > Editions of SQL Server 2000"). ... >> I am not seeing any unusual messages in the Event Viewer also. ...
    (microsoft.public.sqlserver.programming)
  • Re: Tracing sql server user logins
    ... Now for your question: base auditing ... > GroupName sysname NULL, ... SQL Server does not audit by ... >>Failure causes only failed login attempts to be audited. ...
    (microsoft.public.sqlserver.security)
  • Re: Question on C2 Log
    ... I am now analyzing the trace, ... >> auditing all logins no matter it is successfully or failed? ... >> Audit Level you wanted. ... click SQL Server and Windows. ...
    (microsoft.public.sqlserver.security)
  • Re: failed login attempts
    ... The Hostname of the client computer is captured (for sure in ... You can indeed turn on failed login auditing via a ... You can also capture this information with ... Microsoft SQL Server doesn't have built-in failed logins ...
    (microsoft.public.sqlserver.security)