Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking into some backup issues on an old Sql 2000 server and I've narrowed it down to the fact that the Sql Agent account was changed.

The big question that I have is whether or not I can tell when this was changed and by whom it was changed?


share|improve this question
up vote 1 down vote accepted

The Windows NT logs are the primary place to find when the account was first used - the eventlog comes with a find/filter option. However, it may have rolled depending on the configuration.

Check the SQL logs too - if the last restart was some time ago, it might give you a clue as to when.

If SQL Server is running under a domain account, it would be worth checking AD - many organisations put reference numbers against new accounts etc. Also have a trawl of any incident/request management system you might have.

share|improve this answer

Event Logs can help (specifically the Security log) but only if audit policy for Account management has been set by the administrator.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.