SQL Server Audit Action Group: AUDIT_CHANGE_GROUP

This important group allows you to track changes to audit and audit specification objects which have an impact of course on the audit trail within SQL Server. This group also tracks audit failures and audit session changes. If any auditing is enabled at all on a given server it follows then that this group should certainly be enabled in the server audit specification so that audit trail integrity can be insured.

If you enable this group at the server level, you will track changes to both audit objects and server audit specifications. It will also track changes to all database audit specifications.

If you enable this group in a database it will track changes to database audit specifications within that database.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24043	Issued a change server audit command
24044	Issued a change server audit specification command
24045	Issued a change database audit specification command
24046	Issued a create server audit command
24047	Issued a create server audit specification command
24048	Issued a created database audit specification command
24049	Issued a delete server audit command
24050	Issued a delete server audit specification command
24051	Issued a delete database audit specification command
24052	Audit failure
24053	Audit session changed
24311	Issued a change database audit command
24312	Issued a create database audit command
24313	Issued a delete database audit command

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard