SQL Server: Who dropped a table, find out from Transaction Log

Anvesh Patel — Wed, 24 May 2017 16:16:56 +0000

In this post, I am sharing few steps to find out the transactions history for drop commands which executed in SQL Server.

There are many features for auditing and check the logging in SQL Server, but you can also directly read the transaction log and can get the necessary details.

Please check the below full demonstration of this:

Create a sample database and use it:

CREATE DATABASE Drop_Test
GO
USE Drop_Test
GO

Create a sample table:

CREATE TABLE tbl_Test (ID INT)
GO

Check the object id of table and save it:

SELECT OBJECT_ID ('tbl_Test')
GO

--tbl_Test object id: 581577110

Now, drop the table:

DROP TABLE tbl_Test
GO

Check the transaction id and user of that drop action:
Using below query, you can find only transaction id and username who dropped the objects. Later, you can use a transaction to know which object has been dropped.

SELECT [Transaction Id], [Begin Time], SUSER_SNAME ([Transaction SID]) AS [User]
FROM fn_dblog (NULL, NULL)
WHERE [Transaction Name] = 'DROPOBJ'
GO

-- The Result:
/*
Transaction Id Begin Time User
-------------- ------------------------ ---------
0000:00000335 2017/04/25 17:53:41:187 Anvesh
*/

Find out which object has been dropped:
Use above transaction id and see the details of dropped object.

SELECT [Transaction Id], [Begin Time], SUSER_SNAME ([Transaction SID]) AS [User]
FROM fn_dblog (NULL, NULL)
WHERE [Transaction Name] = 'DROPOBJ'
GO

-- The Result:
/*
Transaction Id Begin Time User
-------------- ------------------------ ---------
0000:00000335 2017/04/25 17:53:41:187 Anvesh
*/

object security – Database Research & Development

SQL Server: Who dropped a table, find out from Transaction Log