In a highly secure environment, the Windows security log is an appropriate place to write events accessed by recorded objects. Other audit locations are also supported, but they are more vulnerable to tampering.

There are two key requirements for writing SQL Server server audits to the Windows security log:

Audit object access settings must be configured to capture events. You can use the best configuration method according to your operating system.

In Windows Vista and Windows Server 2008, use the audit policy tool (

auditpol.exe

)。 Audit policies and procedures are open.

Audit object access

Multi-sub-policy settings in categories. To allow SQL Server audit object access, configure

Settings generated by the application.

For earlier versions of Windows, the Audit Policy tool is not available. Please use the Security Policy snap-in (secpol.msc) instead.

)。 If available, the audit policy is the preferred policy, because more granular settings can be configured.

The account running the SQL Server service must have

Generate security audit

Permission to write to the Windows security log. By default, local service and network service accounts have this right. If SQL Server is running under one of the accounts, this step is not required.

When the Windows audit policy is configured to write to the Windows security log, it may affect the audit of SQL Server. At this time, if the audit policy is not configured correctly, it may lead to the loss of events. Typically, the Windows security log is set to overwrite old events. This keeps the latest events. However, if the Windows security log is not set to overwrite the old events, the system will issue the Windows event 1 104 when the security log is full. At this point:

Security events will no longer be logged.

SQL Server will not be able to detect whether the system can record events in the security log, which may lead to the loss of audit events.

The log behavior will return to normal after the machine administrator repairs the security log.

Administrators of SQL Server computers should be aware that the local settings of security logs may be overridden by domain policies. In this case, the domain policy can override the subcategory settings (

Audit/Acquisition/Subcategory: "Application Generated"

)。 This may affect the ability of SQL Server to record events, and it is impossible to detect whether the events that SQL Server tries to audit will not be recorded.

You must be a Windows administrator to configure these settings.