- Run SQL Management Studio and execute the following T-SQL code to create and enable a SQL Server audit and a SQL Server audit specification, adjusting the path to the logs as needed:
-- Create a server audit.
CREATE SERVER AUDIT AuditSQL
TO FILE ( FILEPATH ='\\SQL\Audit\' )
WITH ( QUEUE_DELAY = 1000, ON_FAILURE = CONTINUE );
GO
-- Create a server audit specification for login password changes.
CREATE SERVER AUDIT SPECIFICATION User_pw_change
FOR SERVER AUDIT AuditSQL
ADD (LOGIN_CHANGE_PASSWORD_GROUP);
GO
-- Enable the audit.
ALTER SERVER AUDIT AuditSQL
WITH (STATE = ON);
GO
- To view login password changes, execute the following code in SQL Management Studio:
SELECT * FROM sys.fn_get_audit_file ('\\SQL\Audit\*',default,default)
WHERE action_id = 'PWR'
GO
- Open the file produced by the script in MS Excel.

- Run Netwrix Auditor → Navigate to "Search" → Click on "Advanced mode" if not selected → Set up the following filters:
- Filter = "Data Source"
Operator = "Equals"
Value = "SQL Server" - Filter – "Details"
Operator = "Contains"
Value = "Password"
- Filter = "Data Source"
- Click the "Search" button and review what changes were made to passwords.
