SQL Server Audit Action Group: DATABASE_ROLE_MEMBER_CHANGE_GROUP

This group tracks membership additions and removals on database roles.

If you enable this group in a server audit specification, that will track all new and remove members and database roles in all databases throughout the entire SQL Server instance. If you enable this group in a database audit specification, it will only track membership changes on database roles within that particular database.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24020	Add member to database role succeeded
24021	Add member to database role failed
24022	Remove member from database role succeeded
24023	Remove member from database role failed

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard