Catch create user with extended events

Miyagi82 1 Reputation point
2022-04-19T14:58:22.69+00:00

Hello,

I try to catch in extended events session the creation/deletion of a new login.
Already added object_created/object_altered/object_deleted but no success.

I also want to catch the grant and revoke events for the users in extended events.
How can I do that?

Thank you!

SQL Server
SQL Server
A family of Microsoft relational database management and analysis systems for e-commerce, line-of-business, and data warehousing solutions.
12,654 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Erland Sommarskog 100.8K Reputation points MVP
    2022-04-19T22:00:52.13+00:00

    You should probably look at SQL audit instead, which uses the Extended Events framework under the covers.

    0 comments
  2. YufeiShao-msft 7,056 Reputation points
    2022-04-20T08:49:50.143+00:00

    Hi @Miyagi82 ，

    For your needs, all can be implemented using SQL Server Audit
    you have to audit(like via ddl) the actual REVOKE or DENY statement.
    In SQL Server log, from the default track, you also can see some event about logins and objects are changed
    https://www.sqlservercentral.com/articles/find-permission-changes-in-the-default-trace

    -------------

    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments