How about simply denying them permission to access that database through normal SQL Server security practices. The DDL trigger to log database events will need to have permission to write to the table, but it can run under an account designed for that. Then you eliminate whole levels of complexity.
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon