24078: Issued a disable server principal command
An SQL server principal is an entity that can request server resources. Every server principal in SQL has a security identifier. Event 24078 occurs when a command to disable an SQL server principal has been issued. It is generated by the SERVER_PRINCIPAL_CHANGE_GROUP action group. Important information can be derived from this event including the:
- Date and time at which the event occurred.
- Session identifier of the event.
- Privileged user who performed the action.
- Server associated with the event.
- ID, name and type of the target object (in this case, the SQL server login).