SQL Server Audit Action Group: DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP

This group tracks changes of ownership on database objects including certificates, symmetric and asymmetric keys, assemblies and schemas.

This is an important audit action group because ownership changes are significant to the security of the system.

If you enable this group in a database audit specification, it will track ownership changes on database objects within that database only. If you enable this group in a server audit specification, it will track ownership changes on database objects in all databases within that SQL Server instance.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24148	Issued a change schema owner command
24150	Issued a change role owner command
24151	Issued a change database object owner command
24152	Issued a change symmetric key owner command
24153	Issued a changed certificate owner command
24154	Issued a change asymmetric key owner command
24349	Issued a change assembly owner command

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard