Monitor SQLExec account

[timscronin]

Have an urgent matter.
We have a thought that someone might have obtained/hacked the password from our SQL Exec account. Is there a way to monitor when that account is being logged in and from what workstation? This is for any activity not just connecting to the sql server

 

[SQLBill]

Here's a script I run through Profiler. It only gets accesses to SQL though.

DECLARE @TraceID int, @ON bit
SET @ON = 1
EXEC sp_trace_create @TraceID OUTPUT, 2, N'L:\Traces\CrystalTrace'
SELECT 'TraceID' = @TraceID

--Set what events need to be recorded
--Login with Application Name
EXEC sp_trace_setevent @TraceID, 14, 10, @ON
--Login with Login
EXEC sp_trace_setevent @TraceID, 14, 11, @ON
--Login with Domain Name
EXEC sp_trace_setevent @TraceID, 14, 7, @ON
--Login with Start Time
EXEC sp_trace_setevent @TraceID, 14, 14, @ON
--Login with Duration
EXEC sp_trace_setevent @TraceID, 14, 13, @ON

--Log Out with Application Name
EXEC sp_trace_setevent @TraceID, 15, 10, @ON
--Log Out with Login
EXEC sp_trace_setevent @TraceID, 15, 11, @ON
--Log Out with Domain Name
EXEC sp_trace_setevent @TraceID, 15, 7, @ON
--Log Out with Start Time
EXEC sp_trace_setevent @TraceID, 15, 14, @ON
--Log Out with Duration
EXEC sp_trace_setevent @TraceID, 15, 13, @ON

--Start the trace
EXEC sp_trace_setstatus @TraceID, 1

--return information about the trace
select *
from :: fn_trace_getinfo(@TraceID)

select *
from :: fn_trace_geteventinfo(@TraceID)

select *
from :: fn_trace_getfilterinfo(@TraceID)

--Stop the trace
--EXEC sp_trace_setstatus 1, 0

--Close the trace
--EXEC sp_trace_setstatus 1, 2

-SQLBill