RE: Security Audit Level

From: Michael Cheng [MSFT] (v-mingqc_at_online.microsoft.com)
Date: 05/06/04 

Date: Thu, 06 May 2004 04:15:07 GMT

Hi Lijun,

Thanks forJasper and Greg's reply.

Based on my knowledge, we use Audit level to select the level at which user
accesses to Microsoft SQL Server are recorded in the SQL Server error log.
     None causes no auditing to be performed.
     Success causes only successful login attempts to be audited.
     Failure causes only failed login attempts to be audited.
     All causes successful and failed login attempts to be audited.

Moreover, detailed information for SQL Server 2000 Audit could be found at
How to set up Mixed Mode security (Enterprise Manager)
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/howtosql/ht
_6_secrty_2dh5.asp

SQL Server 2000 Auditing
By John Howie
http://www.microsoft.com/technet/security/prodtech/dbsql/sql2kaud.mspx

Chapter 18 ¨C Securing Your Database Server
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht
ml/THCMCh18.asp

John Howie's SQL Server 2000 Auditing will give you a general view on
architecture of SQL Server auditing, while Securing Your Database Server
give you more project experience.

Anyway, Microsoft recommends auditing, at minimum, failed login attempts.
Auditing failed login attempts helps determine if unauthorized users are
attempting to access the system, which, I believe, will be more helpful to
troubleshooting

Thank you for your patience and cooperation. If you have any questions or
concerns, don't hesitate to let me know. We are here to be of assistance!

Sincerely yours,

Michael Cheng
Microsoft Online Support
***********************************************************
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks.

Relevant Pages

  • Re: Tracing sql server user logins
    ... >You have to start auditing, SQL Server does not audit by ... >Failure causes only failed login attempts to be audited. ... >All causes successful and failed login attempts to be ...
    (microsoft.public.sqlserver.security)
  • Re: Full Text Indexing on Microsoft SQL Server 2000 with Windows XP Pro
    ... I went in there and I found the Auditing level set to None which ... > Editions of SQL Server 2000"). ... >> I am not seeing any unusual messages in the Event Viewer also. ...
    (microsoft.public.sqlserver.programming)
  • Re: Tracing sql server user logins
    ... Now for your question: base auditing ... > GroupName sysname NULL, ... SQL Server does not audit by ... >>Failure causes only failed login attempts to be audited. ...
    (microsoft.public.sqlserver.security)
  • Re: Question on C2 Log
    ... I am now analyzing the trace, ... >> auditing all logins no matter it is successfully or failed? ... >> Audit Level you wanted. ... click SQL Server and Windows. ...
    (microsoft.public.sqlserver.security)
  • Re: failed login attempts
    ... The Hostname of the client computer is captured (for sure in ... You can indeed turn on failed login auditing via a ... You can also capture this information with ... Microsoft SQL Server doesn't have built-in failed logins ...
    (microsoft.public.sqlserver.security)