SQL Server Audit Action Group: DATABASE_OWNERSHIP_CHANGE_GROUP

This group tracks ownership changes on the actual database. If you enable this group in a server audit specification that will track ownership changes on all databases within that SQL Server instance. If you enable this group in a database audit specification it will track ownership changes to that database only.

Since ownership is important to the database and information with it, this is an important group to audit.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24147	Issued a change database owner command

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard