RE: SQL logins logged where
From: Kevin McDonnell [MS] (kevmc@online.microsoft.com)
Date: 01/03/03
- Next message: Narayana Vyas Kondreddi: "Re: Retrieve the IP Address from a Failed Login Attempt"
- Previous message: Kevin McDonnell [MS]: "Re: Retrieve the IP Address from a Failed Login Attempt"
- In reply to: kvsvarma: "SQL logins logged where"
- Next in thread: GS: "RE: SQL logins logged where"
- Reply: GS: "RE: SQL logins logged where"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: kevmc@online.microsoft.com (Kevin McDonnell [MS]) Date: Fri, 03 Jan 2003 21:47:27 GMT
Enable SQL Server auditing for successfull and failed logins.
Right click on the server in Enterprise Manager, Properties, Security Tab,
Select audit for successfull & failed logins (All).
Restart SQL Server.
Review the NT Application Event log and/or SQL Server Errorlog.
or
Setup a machine to run profiler & dump the results to a table. Add the
security event under Security Audit for Login Failed.
Review your audit tables as needed.
Thanks,
Kevin McDonnell
Microsoft SQL Server
This posting is provided AS IS with no warranties, and confers no rights.
Are you secure? For information about the Microsoft Strategic Technology
Protection Program and to order your FREE Security Tool Kit, please visit
http://www.microsoft.com/security.
- Next message: Narayana Vyas Kondreddi: "Re: Retrieve the IP Address from a Failed Login Attempt"
- Previous message: Kevin McDonnell [MS]: "Re: Retrieve the IP Address from a Failed Login Attempt"
- In reply to: kvsvarma: "SQL logins logged where"
- Next in thread: GS: "RE: SQL logins logged where"
- Reply: GS: "RE: SQL logins logged where"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|