Catch create user with extended events

Question

Hello,

I try to catch in extended events session the creation/deletion of a new login.
Already added object_created/object_altered/object_deleted but no success.

I also want to catch the grant and revoke events for the users in extended events.
How can I do that?

Thank you!

Answer 1

Hi @Miyagi82 ，

For your needs, all can be implemented using SQL Server Audit
you have to audit(like via ddl) the actual REVOKE or DENY statement.
In SQL Server log, from the default track, you also can see some event about logins and objects are changed
https://www.sqlservercentral.com/articles/find-permission-changes-in-the-default-trace

-------------

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

You should probably look at SQL audit instead, which uses the Extended Events framework under the covers.