I currently got 2 DEV SQL Servers which is used by 4 Developers for their day to day work.
Yesterday, data out of few tables on DEV instance got deleted
Now I’m struggling how to track back who had deleted the data as everybody is saying they haven’t deleted the data. Only failed login auditing was enabled on SQL Server
How can we track back – who deleted the data on that SQL SERVER?
Is there any way moving forward, I can keep track of DELETE/DROP statement which someone is executing on SQL SERVER
Regards
Unless you have some form of auditing on that database or these tables, there’s no way to find out who exactly did that.
If you want to be able to know who did it, then implement DML triggers to send auditing data to audit tables.