get the last modifed user for a sql job agent job - sql-server

Question

The schedule for one of my job agents jobs has recently been disabled, is there anyway to find out any information other than last modified date on who or what disabled the job schedule?

Answer 1

SQL Server doesn't audit this information by default, so no, this data is not going to be available to you after the fact. (I checked the default trace and it doesn't seem to be logged there.) If you haven't since re-enabled the job, you may be able to correlate the value in msdb.dbo.sysjobs.modified_date with other information that is logged, but I have no idea what other events you might be able to ascertain belong to the same user as the one who modified the job. Again, if the job hasn't already been modified (or you know when it was modified before you fixed it), and assuming the change happened in the timeframe that is still within your current rolling window for the default trace, you can check for other activity around the same time:
DECLARE #ModifiedDate DATETIME;
SET #ModifiedDate = -- plug in the value here
DECLARE #path NVARCHAR(260);
SELECT #path = REVERSE(SUBSTRING(REVERSE([path]),
CHARINDEX(CHAR(92), REVERSE([path])), 260)) + N'log.trc'
FROM sys.traces WHERE is_default = 1;
SELECT * FROM sys.fn_trace_gettable(#path, DEFAULT)
WHERE EndTime >= DATEADD(MINUTE, -30, #ModifiedDate)
AND EndTime < DATEADD(MINUTE, 30, #ModifiedDate)
ORDER BY EndTime DESC;
You could set up your own server-side trace, extended events session, event notification or audit to make sure that you are able to audit this information in the future (or simply restrict the ability of your whole team to mess with jobs).

Answer 2

The easy part is to find what jobs and/or schedules that have been disabled recently.
-- Use msdb
use msdb
go
-- Jobs that have been recently disabled
select
[name], [enabled], [date_created], [date_modified]
from sysjobs
where [date_modified] > '2013-09-30' and enabled = 0
order by [date_modified] desc
go
-- Schedules that have been recently disabled
select
[name], [enabled], [date_created], [date_modified]
from sysschedules
where [date_modified] > '2013-09-30' and enabled = 0
order by [date_modified] desc
go
Unless the user or sysadmin took ownership of the job, it is hard to find out who did it.
Things that I thought of but did not work were the following.
1 - Any entries in the server or agent logs? NO DICE
2 - Does the default server side trace pickup the event? NO DICE
3 - Can I look at the transaction log to find the person? MSDB uses a simple recovery model. NO DICE
4 - Does the health check (extended events) track this information. Which I doubted, but wanted to check. NO DICE
5 - Since this is not an error, nothing gets logged in windows events. NO DICE
Therefore, after a couple google searches, I think you are down to a couple solutions.
A - Create a trigger on the appropriate system table and save audit information.
See my blog on 'How to audit and prevent unwanted user actions.'. It is a full blown presentation that I do at SQL Saturdays.
B - Create a http://www.bimonkey.com/2009/12/sql-server-2008-auditing/ audit specification but you will have to read the output file.
C - Add a server side trace or extended event to capture the data.
Good luck.
John