SELECT I.*FROM sys.traces T CROSS Apply :: fn_trace_gettable(CASE WHEN CHARINDEX('_', T.[path]) <> 0 THEN SUBSTRING(T.PATH, 1, CHARINDEX('_', T.[path]) - 1) + '.trc' ELSE T.[path] End, T.max_files) I JOIN sys.trace_events AS TE ON I.EventClass = TE.trace_event_id WHERE TE.[name] = 'Audit Login Failed'
SELECT I.NTUserName, ..... {Removed for brevity} ... I.LoginSid is not nullGroup By I.NTUserName, I.loginname, I.SessionLoginName, I.databasename, S.principal_id, S.sid, S.type_desc, S.name
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
Sometimes, winning is not an issue but trying.
You can check my BLOG here
