SELECT I.*FROMsys.traces TCROSS Apply ::fn_trace_gettable(T.path, T.max_files) IJoin sys.trace_events E On I.eventclass = E.trace_event_idWhere T.id = 1 AndE.name = 'Object:Altered' and ObjectName like '%UAC_AdminAccess%'
No comments:
Post a Comment