none
Who stopped my SQL Services ? RRS feed

  • Question

  • Hi All,

    Is there a way to find out which windows user has stopped or started a SQL Service?
    I testing purpose, on my local laptop i tried to stop SQL Agent service  and then tried to check the Windows Application Event log. It shows User as N/A ? why ?
    Is there a way to find out who/which user has stopped the SQL Services ?

    Thanks,
    Sam

    Saturday, December 7, 2019 10:20 AM

All replies

  • It shows User as N/A ? why ?
    Is there a way to find out who/which user has stopped the SQL Services ?

    That's nothing SQL Server related, more Windows Server one. And it was a person with local admin permission on the machine.

    Olaf Helper

    [ Blog] [ Xing] [ MVP]

    Sunday, December 8, 2019 3:32 AM
    Moderator
  • And it was a person with local admin permission on the machine.

    Not necessarily, as SQL Server can be shut down with the  SHUTDOWN command, adding WITH NOWAIT for extra spice. In this case. the login who submitted the command is recorded in the SQL Server errorlog.

    But in the more normal case that the service is stopped through Windows (SSCM, Services, NET STOP), the errorlog only says that it was a request from the Service Control Manager.

    And, as Olaf says, to find the user in this case is more of a Windows question. I would assume that the problem is the same with all Windows services. And, yes, in this case it has to be someone who has admin permissions on the machine.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

    Sunday, December 8, 2019 10:16 AM
  • Yes. it is a user who is local admin. But in case , if we want to track down who stopped sql services, then as a sqladmin can we do any kind of logging before shutting the services down ?
    Sunday, December 8, 2019 2:20 PM
  • Yes. it is a user who is local admin. But in case , if we want to track down who stopped sql services, then as a sqladmin can we do any kind of logging before shutting the services down ?

    If it was done locally, you should be able to tell which persons that were logged in on the Windows server SQL server shut down. I believe this can be concluded from the Security event log in Windows. (But for a better answer, consult a Windows forum.)

    But this very question makes me uneasy. If you really need to know this, you have a problem in your organisation. If the Windows admin shuts down SQL Server without approval or discussion with you as the DBA there is something wrong which you need to bring up with your manager.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

    Sunday, December 8, 2019 3:42 PM
  • Hi Sam,

    Your issue is more related to Windows Server. I suggest you open a thread in Windows Server forum so that people there will help you more effectively.

    >>Is there a way to find out which windows user has stopped or started a SQL Service?

    You could check the Windows Event viewer->Windows Log->Application log.

    Event ID 17148 shows shutdowns initiated by the Service Control Manager. And Event ID 17162 means

    SQL Server is starting at normal priority base.

    You could get the start / stop time of a service from the system event log, but usually the user is shown as a SYSTEM or N / A account. You may need to compare the user's login time.

    In addition, you could run the default trace which may help you see what happened. For more details, please refer to this similar thread.

    Hope this could help you.

    Best Regards,

    Amelia Gu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Monday, December 9, 2019 8:30 AM
  • Yes. it is a user who is local admin. But in case , if we want to track down who stopped sql services, then as a sqladmin can we do any kind of logging before shutting the services down ?
    Have you checked my first post?
    Monday, December 9, 2019 8:32 AM
  • Samantha could you check below post, it says if you did by service control manager or services.msc it should get logged in default trace

    https://dba.stackexchange.com/questions/86967/how-to-identify-who-or-what-is-restarting-sql-services-via-service-control

    PS: I dont think it will always work but give it a try on your local machine


    Cheers,

    Shashank

    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

    My TechNet Wiki Articles

    MVP


    Monday, December 9, 2019 11:44 AM
    Moderator
  • Hi Sam,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If not, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Amelia Gu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Friday, December 13, 2019 9:48 AM