Logging object permission changes

[JohnDTampaBay]

I need to be able to track changes to object permissions on my server. My first thought was to create triggers for SysUsers and SysProtects to log the changes and then schedule a nightly task to select logged changes that happened that day and email me. But, of course, it isn't possible to create triggers on system tables.

Does anyone have any ideas as to how I can log changes to object permissions in SQL without putting triggers on system tables?

Thanks in advance, folks. If this has an answer, I'm sure this group will find it.
--Angel
-----------------------------------
SELECT * FROM users WHERE clue > 0
0 row(s) selected

 

[JohnDTampaBay]

OK. I found the code I need to apply triggers to SysUsers and SysProtects (sp_configure), but I am hoping for a more graceful solution. Any ideas??? --Angel
-----------------------------------
SELECT * FROM users WHERE clue > 0
0 row(s) selected

 

[tlbroadbent]

Create a trace that logs all GRANT, REVOKE and DENY statements. Terry L. Broadbent - DBA
Computing Links:

http://tlbroadbent.home.attbi.com/prog.htm

faq183-874 contains "Suggestions for Getting Quick and Appropriate Answers" to your questions.