How to find out what is adding a login trigger to my MSSQLLocalDB?

Question

I keep having trouble with logging into (localdb)\MSSQLLocalDB. It gives the error:

Logon failed for login 'Domain\user' due to trigger execution.
Changed database context to 'master'.
Changed language setting to us_english.

When in this state I can't do much diagnostics because I can't log into it. I've been getting out of this with the following shell command.

SqlLocalDb stop MSSQLLocalDB -k
SqlLocalDb delete MSSQLLocalDB

I can then create a new database by logging into the database again, but obviously all data is lost. Trouble is that a few days later the same thing happens again. I'm fairly certain I'm not adding any login triggers. I work on a corporate network and wouldn't be at all surprised if some rogue security tool is doing it.

I'm wondering if there is any way of seeing the trigger or capturing diagnostics without being able to login?

Answer 1

Is there any way of seeing the trigger without being able to login?

I think if you login using DAC it will bypass login trigger so you can view login triggers and disable them.

Is there some way I can get a log of what added the trigger or what caused it to fail, again without using my login?

Turn on SQL audit to catch trigger creation to get details.

Is there some way I can stop tools which may be running with my account or an admin account from adding login triggers?

As soon as you figure out an account who created the trigger you can do something about it.