Thursday, 20 February 2014

Logon Trigger to audit last Login

Now I will show you how to create a Logon Trigger on a Server
to safe the last login on a server for each user.

This script is useful searching no longer used Logins on a Server. 

Copyable Version:
USE [Login_Audit]

CREATE TABLE [dbo].[Login_Audit](
    [SID] [varbinary](85) NOT NULL,
    [Login] [sysname] NOT NULL,
    [User] [nvarchar](128) NULL,
    [Last_Login] [datetime] NULL
) ON [PRIMARY]

GRANT SELECT ON [dbo].[Login_Audit] TO [public]
GRANT UPDATE ON [dbo].[Login_Audit] TO [public]

INSERT INTO [dbo].[Login_Audit]
select [sid], name, NULL, NULL from sys.server_principals

CREATE TRIGGER [LogonTimeStamp]
ON ALL SERVER FOR LOGON
AS
BEGIN
update [Login_Audit].[dbo].[Login_Audit]
set        Last_Login = GETDATE(), [user] = user
where SID = suser_sid(SYSTEM_USER)
END

ENABLE TRIGGER [LogonTimeStamp] ON ALL SERVER


select *
from [Login_Audit].dbo.[Login_Audit]
where [LOGIN] = 'NT AUTHORITY\SYSTEM' -- use a own user here

-- Insert after Creating new Login
INSERT INTO [dbo].[Login_Audit]
select [sid], name, NULL, NULL
from sys.server_principals
where [sid] not in (select sid from [dbo].[Login_Audit])

No comments:

Post a Comment