imran-k - Tuesday, December 26, 2017 6:09 AM
Capture logins (including but not limited Original_Login()), capture host and other machine names and, possibly, capture what's running using some of the system DMVs. Sp_WhoIsActive (by Adam Machanic is helpful there if you don't want to build your own).
--Jeff Moden
Change is inevitable... Change for the better is not.