Treating privileged activity as inherently trustworthy is a security mistake. DBAs, contractors, managed-service staff, or compromised administrative accounts can alter systems, so every privileged action needs accountability and rapid investigation. section 14.5
SQL Server Audit provides lightweight auditing for server and database events. Writing results to the Windows security log helps prevent SQL Server administrators, including sysadmins, from tampering with the record. section 14.5
Before relying on a tamper-resistant administrative audit:
- Enable application-generated audit events through auditpol. section 14.5
- Grant the SQL Server service account the Generate Security Audits user right in secpol.msc. section 14.5
- Configure success and failure auditing for the audit-object policy, then restart the server. section 14.5
Named scenario: AdminActivityAudit
Create an audit that writes to SECURITY_LOG and specifies failure behavior, then attach an audit specification covering role-member changes, audit changes, DBCC, permission changes, impersonation, object changes, configuration operations, and server-state changes.
