SQL Server data change and Security

Question

in our environ any user who login with sa they can change any table data.
so i write trigger to capture changed data like who change, from which IP etc this
CREATE TRIGGER [TRG_Users]
ON [dbo].[UserRights] AFTER INSERT, UPDATE, DELETE
AS
DECLARE @strIP VARCHAR(MAX)
SET @strIP=(SELECT dbo.GetCurrentIP())
IF EXISTS (SELECT * FROM INSERTED) AND EXISTS (SELECT * FROM DELETED)
--PRINT 'Update happened';
INSERT INTO Logger(IPAddress,Status)
VALUES (@strIP,'UPDATE')
ELSE
IF EXISTS (SELECT * FROM INSERTED)
--PRINT 'Insert happened';
INSERT INTO Logger(IPAddress,Status)
VALUES (@strIP,'INSERT')
ELSE
--PRINT 'Delete happened';
INSERT INTO Logger(IPAddress,Status)
VALUES (@strIP,'DELETE')
CREATE FUNCTION [dbo].[GetCurrentIP] ()
RETURNS varchar(255)
AS
BEGIN
DECLARE @IP_Address varchar(255);
SELECT @IP_Address = client_net_address
FROM sys.dm_exec_connections
WHERE Session_id = @@SPID;
Return @IP_Address;
END
but the problem is user can change data after disabling the trigger on specific table. so trigger will not fire and user can seamlessly change data.
so guide me what is the best way to capture data change and log them. so no one can bypass the security. please do not tell me disable sa account because i am looking for different approach to capture the change data. is there any secure way exist in sql
server 2005/2008 if yes then please discuss here. thanks

Answer 1

If you have shared SA password with different users you are bound to get these scenarios.Instaed of focussing on how to capture I would like you to talk with different users and only provide them access which is required.Follow policy f minimum privilege
your environement will be less complex .
You can use combination of Logon trigger and CDC to capture it.But again why o make things complex by sharing SA password with many users.
https://www.simple-talk.com/sql/learn-sql-server/introduction-to-change-data-capture-%28cdc%29-in-sql-server-2008/
Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers