October 8, 2008 at 7:20 am
Is there a way to capture when a system level setting is changed? Specifically, is an event generated when the authentication mode is changed from one state to another? I have a situation where it is changing at random and I need to determine what (or who) is changing it.
Thanks....JC III
October 8, 2008 at 8:12 am
Not in 2000. In 2005 there are DDL triggers.
I used to capture the output of various things, like sp_configure, every day and store it in a table. The compare it the next day and go track things down if there was a change. In a small company this works. In a larger company, you can trace all activity by logins that have privileges to do that.
October 8, 2008 at 8:20 am
Start by checking who is in the sysadmin and serveradmin roles as you need to be one of those to make that change. You could also change the sa password to make sure that it has not been compromised. Is the Builtin\Administrators windows group still granted access to the server and, if so, is it still in the sysadmin role?
Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question
Viewing 3 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply