SQL Server Audit Action Group: SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP

This group tracks attempts to grant, deny or revoke permissions on schema objects such as a table, view or stored procedure.

This is an important audit action group because permission changes are critical to the security of the server and the information on it.

If you enable this group in a database audit specification, it will track permission changes to schema objects within that database only. If you enable this group in a server audit specification, it will track permission changes to schema objects in all databases within that SQL Server instance.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24249	Issued grant schema object permissions command
24250	Issued grant schema object permissions with grant command
24251	Issued deny schema object permissions command
24252	Issued deny schema object permissions with cascade command
24253	Issued revoke schema object permissions command
24254	Issued revoke schema object permissions with grant command
24255	Issued revoke schema object permissions with cascade command
24256	Issued grant schema type permissions command
24257	Issued grant schema type permissions with grant command
24258	Issued deny schema type permissions command
24259	Issued deny schema type permissions with cascade command
24260	Issued revoke schema type permissions command
24261	Issued revoke schema type permissions with grant command
24262	Issued revoke schema type permissions with cascade command
24263	Issued grant XML schema collection permissions command
24264	Issued grant XML schema collection permissions with grant command
24265	Issued deny XML schema collection permissions command
24266	Issued deny XML schema collection permissions with cascade command
24267	Issued revoke XML schema collection permissions command
24268	Issued revoke XML schema collection permissions with grant command
24269	Issued revoke XML schema collection permissions with cascade command

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard