Kevin Hill discusses failed logins:
We’ve all seen them.
Login failed for user ‘MyDomain\Bob’ (password issue)
Login failed for user ‘MyDomain\Nancy’ (default database issue)
Login failed for user ‘blah, blah, blah…’But what about Login Failed for user ‘Insert Chinese characters here’, Reason, An attempt to logon using SQL Authentication failed.
Wait…nobody in the company has a username with Chinese characters. And we don’t have SQL Authentication turned on….
I generally agree with Kevin’s assessment, but have one big point of contention: he recommends turning off successful login logging. I think that’s not a great thing to do, particularly for a company with a mature security team. Think about this scenario: if you see four or five failed login attempts for sa, and you don’t use sa in your environment, you know somebody’s trying something sneaky. If you see four or five failed login attempts for sa and then a successful login attempt for sa, you know they succeeded. If you don’t log successful login attempts, you lose that critical piece of information.