In my last post I hoped to convince you to pay attention to all of the various “Login Failed for user…” messages that you see in your SQL Server ERRORLOGS. ALL of them.
Yes, some you can ignore based on the environment or the person. Jim the web guy on a Dev box is just not that much of a security threat (unless you let him touch Prod, but that’s a different post).
Some of you have one or two servers, and reviewing ERRORLOGs is no big deal to do manually. More of you have tens and tens of them. Some of you have thousands (I’m looking at you in Managed Hosting environments such as Verizon, Rackspace, etc. where customers pay you to do this).
The next step up from there is Central Management Servers.