Post reply

Security events. Special Logon

  • June 28, 2011 at 9:06 am

    #242873

    Hi,

    In one of our server we are getting security audit logs with event Id 4672 (Special privileges assigned to new logon). I am not able to figure it out why the account is given special previlege and from where it is logging to the server?

    Any help will be appreciated.

    Ryan
    //All our dreams can come true, if we have the courage to pursue them//

  • June 28, 2011 at 9:28 am

    #1345266

    You may want to look into the default trace.

    This should help you investigate that file

    http://blogs.technet.com/b/beatrice/archive/2008/04/29/sql-server-default-trace.aspx

    Jason...AKA CirqueDeSQLeil
    _______________________________________________
    I have given a name to my pain...MCM SQL Server, MVP
    SQL RNNR
    Posting Performance Based Questions - Gail Shaw[/url]
    Learn Extended Events

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply