MSSQL Audit Log

Question

I renamed sa account and disabled. Why my audit log showing sa activities?

EventTime server_principal_name session_server_principal_name statement
14-11-20 0:56 sa

What is this entry for sa account because I don't have sa account

Answer 1

Good day,

Please execute the following query to check if the sa account you see is the real original sa account:

SELECT name
FROM sys.sql_logins
WHERE sid = 0x01;

The sa account always has 0x01

Ensure no other logins are named sa

SELECT sid, name
FROM sys.sql_logins
WHERE name = 'sa';

Next check in the audit log what this sa account is doing (maybe simply an attempt to connect by someone and it failed ?)

Answer 2

Yes verified using the above query. no sa account

Answer 3

audit log all fields are empty except serer principle name and date

Answer 4

Thanks for your reply. My problem not solved. I don't have sa account but audit log captured the sbove sa activity. I already verified no sa ac in my sqlserver

Answer 5