Checking the Error Log III

The Hidden Security Risks of Role Combination in SSAS Tabular

See how security in SSAS tabular models might not work as you expect, and how you could easily fail an audit.

How a Microsoft-signed SQL Server stored procedure lets sysadmins bypass disabled xp_cmdshell

Discover how a Microsoft-signed system procedure bypasses SQL Server's disabled xp_cmdshell setting - plus detection and mitigation steps for defenders

Why SQL Server’s default trigger execution model is a security flaw – and what Microsoft should do about it

The situation raises a question I’ve been thinking for a while: why does SQL Server allow trigger code to inherit the privileges of whichever principal happens to fire it?

SQL Server login failures: how to monitor, report, and alert on them

This guide walks through how to pull login failure data using sys.xp_readerrorlog, filter it by time and error type, parse it into readable columns, aggregate repeat offenders, and automatically email a summary report — turning a passive log file into an active security and troubleshooting tool.

How Azure Arc allows a DB admin to become SQL Server sysadmin – the vulnerability explained

Azure Arc-enabled SQL Server is designed to bring on-premises and multi-cloud SQL Server instances under centralized Azure management, but a newly documented privilege escalation technique shows how that same management workflow can be turned against the server it’s meant to protect.

Admin Rights for Everyone

Steve thinks administrator rights for too many people is a bad idea, but even when it's a limited group, he recommends some sort of governance.

How a SQL Server backup can execute attacker code during restore

CVE-2026-47295 is a SQL Server vulnerability that lets a maliciously crafted database backup execute attacker-controlled code with sysadmin privileges during a routine RESTORE DATABASE operation.

How SQL Server maintenance becomes an attack path – and what to do about it

The article covers four connected areas: over-privileged database users, msdb and SQL Server Agent exposure, privileged maintenance jobs, and trigger-based permission hijacking.

Symmetric Key Encryption