Suspection of sabotage

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hi,
I suspect that someone in our LAN using software other that our commercial
application is damaging data on our SQL server (Microsoft 2000 SB). I need
help to find the person(s) and what is doing

Thanks a lot
Evan Kosteroglou

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

On Sun, 13 Mar 2005 16:18:25 -0800, "Evan Kosterolgou" <Evan
Kosterolgou@discussions.microsoft.com> wrote:

>I suspect that someone in our LAN using software other that our commercial
>application is damaging data on our SQL server (Microsoft 2000 SB). I need
>help to find the person(s) and what is doing

Okay, we'll be right over...

Have you checked SQL logs to see who is accessing the database? Have
you locked access to the database for other than your app?

Jeff

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Thanks Jeff,
No one knows the administrator password for the server and the security is
Windows not SQL
I saw that with SQL profiler I can see a lot of information.
I suppose that from there I can found ip address and sql command (if you
could help me would be nice)
Can also tell me if what I get from the trace files can be used for evidence
even in a court

Thanks again

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

PLEASE
Can someone tell me if I can get from any log or other kind of tracing
a -not editable - (read only) information, so I can used it as evidence

THANKS A LOT