Review unused logins with password metadata, database mappings and activity capture, then use an owner approved disable-first plan.
Hunting Suspicious Objects After a SQL Server Compromise
Investigate a SQL Server compromise by preserving evidence and checking logins, startup procedures, Agent jobs, risky features, and changed objects.
SQL SERVER – Interesting Observation of Logon Trigger On All Servers
I created a Logon Trigger to audit every successful login for a client, and one login was recorded several times on different threads. The script and what I saw.
Reading the Default Trace
Reading the default trace can reveal recent object and configuration changes while its rolling files still retain the evidence.
Who Changed a Server Setting in SQL Server? How to Find Out
Who changed a server setting in SQL Server? The error log records what changed and when, and the default trace adds the login, the computer and the program. Tested with one harmless change that is put back at the end.
A Quarterly Permission Review
A quarterly permission review checks server and database roles, new grants, orphaned users, service accounts, and owner signoff.
Auditing Who Has sysadmin
Audit who has sysadmin in SQL Server, including direct members and Windows groups, then investigate nested access and forgotten logins.