SQL Server Audit Action Group: SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP

This group tracks changes of ownership on "server objects". We are unsure of what constitutes a "server object", but apparently this includes server master keys, server credentials and cryptographic providers.

This would seem to be an important audit action group because ownership changes are significant to the security of the system.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24146	Issued a change server object owner command

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard