MS SQL Server Audit Event: 24101

SQL » 24101: Issued a restore database master key command

24101: Issued a restore database master key command

The database master key is a symmetric key used to encrypt the other keys and certificates in the database and thereby protect them. Event 24101 occurs when a command to restore an already backed up master key of a database in an SQL server has been issued. It is generated by the DATABASE_OBJECT_CHANGE_GROUP action group. Important information can be derived from this event including the:

  • Date and time at which the event occurred.
  • Session identifier of the event.
  • Privileged user who performed the action.
  • Name of the server in which the database, whose master key is to be restored, is present.
  • Database associated with the event.

MS SQL Server Auditing Tool

EventLog Analyzer is a comprehensive log management software with which you can centrally collect, analyze, and manage logs from all the different log sources in your network. You also get reports and alerts on your network security, making it a power-packed IT security tool.