Investigate failed logins with the SQL Server error log and a focused Extended Events session, then group attempts and decide what to do.
Auditing WITH GRANT OPTION: Who Can Hand Out Permissions
Audit WITH GRANT OPTION at database and server scope, trace delegated permissions, and remove delegation with a reviewed CASCADE plan.
CONTEXT_INFO: Passing a Value Through a Session
CONTEXT_INFO lets you attach a small value to a session and read it anywhere in that session, even inside a trigger. This post tests SET CONTEXT_INFO on SQL Server 2025, uses it to log who changed a price, and compares it with SESSION_CONTEXT.
Audit Columns From Day One: CreatedAt, UpdatedAt and Who Changed It
Add audit columns with UTC timestamps and trusted change identities, maintain updates in procedures, and know when history is needed.
Reading the Transaction Log With fn_dblog
fn_dblog can expose transaction-log records during a narrow investigation, but retention and missing user context make it a last resort.
Keeping a Change Log for Every Database
A change log for every database records what changed, when, why, and by whom, with a simple table and a habit of updating it.
Auditing SELECT Statements on Sensitive Tables
Auditing SELECT statements on sensitive tables needs a narrow database audit, protected files, volume checks, and active review.