If you are doing this type of forensics, then IMHO this justifies changing a system stored procedure for the duration of the investigation.
Look at the source of sp_removedbreplication and add code that will log the connection details of who uses it into a table.
Remember to revert back to the standard MS code when you have finished...
Original author: SQL Server FineBuild 1-click install and best practice configuration of SQL Server 2017 2016, 2014, 2012, 2008 R2, 2008 and 2005. 14 Mar 2017
: now over 40,000 downloads.Disclaimer: All information provided is a personal opinion that may not match reality.Quote: When I give food to the poor they call me a saint. When I ask why they are poor they call me a communist. - Archbishop Hélder Câmara