Nonrepudiation makes privileged users accountable for their actions by preserving evidence that links administrative activity to its originator. It matters when many DBAs, contractors, developers, support staff, or managed services have access—or when an administrative account is compromised. section 14.5
Mistake: assuming restricted sysadmin membership is enough. Without administrative auditing, an attacker or insider may alter configuration, permissions, or objects and leave investigators unable to identify what happened. Configure SQL Server Audit to write events to the Windows security log, where SQL Server administrative users cannot tamper with the record. section 14.5
A practical nonrepudiation setup includes:
- Prepare Windows auditing: enable application-generated audit events, grant the SQL Server service account the Generate Security Audits right, and audit successful and failed object-access events. section 14.5
Compromised administrative account
An administrative account begins changing permissions and instance configuration. Audited events provide evidence for identifying the account and disabling it before the attack continues. section 14.5
