locked
Who change policy RRS feed

  • Question

  • Hi,

    Our security team received alert regarding policy change on SQL Server computer. They don't know whether policy changed on windows server or Database server. Just computer name is given there. I checked default reports configuration change. There are some entries but old and new values are both 0. There is no login name or policy name in these dashboard sql server reports.

    Is there any way I can find out what changed and who changed?

    Thanks

    Tuesday, February 5, 2013 9:13 PM

Answers

  • What do you mean "policy change".  This normally refers to a Windows AD policy, not SQL Server.

    If you don't have an audit log turned on, then you cannot look into the past and see what changed in SQL Server.

    • Proposed as answer by Fanny Liu Monday, February 11, 2013 10:00 AM
    • Marked as answer by Fanny Liu Tuesday, February 12, 2013 9:31 AM
    Tuesday, February 5, 2013 9:21 PM

All replies

  • I would look in the Event logs. Go to Event Viewer -->Security to see if anything has changed. this will have both windows and sql server security logs and all the other information you may want

    Hope it Helps!!


    • Edited by Stan210 Tuesday, February 5, 2013 9:19 PM
    Tuesday, February 5, 2013 9:18 PM
  • What do you mean "policy change".  This normally refers to a Windows AD policy, not SQL Server.

    If you don't have an audit log turned on, then you cannot look into the past and see what changed in SQL Server.

    • Proposed as answer by Fanny Liu Monday, February 11, 2013 10:00 AM
    • Marked as answer by Fanny Liu Tuesday, February 12, 2013 9:31 AM
    Tuesday, February 5, 2013 9:21 PM