Once there was a security breach on my client machine and they wanted to know who made changes to the SysAdmin role. They contacted me and my first question was that, are you are auditing such changes and as expected answer was No. I gave them answer that nothing can be done as a consultant. They still wanted my suggestion to prevent this in future. So, they want to track if someone does such things in future. Let us see a script to audit login and role member change.