SQL Clone
SQLServerCentral is supported by Redgate
Log in  ::  Register  ::  Not logged in

Guest Post on SQL Authority – Default Trace & Deleted Databases

I had the opportunity to write another guest post at SQL Authority:

Finding Out What Changed in a Deleted Database

This one covers how to determine who made changes in a database that has been deleted. This isn’t a situation where you can use the schema changes history report because there’s no database to select from in SQL Server Management Studio.

I realize that there’s a limited use for the technique. However, if someone is trying to cover a some sort of mishap (dropped the wrong table, etc.) at simply by deleting a database, this is the quickest way to find out what they did. While we can agree dropping a database is typically a worse mishap to recover from, it’s a foreseeable accident and so one could have just such an “accident” to cover up changes they were attempting to make somewhere they shouldn’t have been (like changing code in production without authorization).

Databases – Infrastructure – Security

Brian Kelley is an author, columnist, and Microsoft SQL Server MVP focusing primarily on SQL Server security. He is a contributing author for How to Cheat at Securing SQL Server 2005 (Syngress), Professional SQL Server 2008 Administration (Wrox), and Introduction to SQL Server (Texas Publishing). Brian currently serves as an infrastructure and security architect. He has also served as a senior Microsoft SQL Server DBA, database architect, developer, and incident response team lead.


Leave a comment on the original post [truthsolutions.wordpress.com, opens in a new window]

Loading comments...