Connections

The 6 checks in the “Connections” category of a SQL Server audit: what each one verifies, its severity and the versions covered.

Checks in this category

CONN001
Active User Connections
Info
Number of active user connections on the instance — a capacity/load baseline.
Versions : 2012-2025
CONN002
Connection Auth Type Distribution
Info
Connection breakdown by authentication type (SQL vs Windows/Entra) — informs identity posture.
Versions : 2012-2025
CONN003
Top Connection Sources
Info
Top client hosts/programs by connection count — identifies the heaviest consumers.
Versions : 2012-2025
CONN004
Connections by Database
Info
Connection count per database — shows how application load is distributed.
Versions : 2012-2025
SESS002
Orphaned DTC/MARS connections
Info
Captures MARS sub-sessions and distributed (DTC) enlisted transactions, indicators of orphaned work.
Versions : 2012-2025
SESS004
Implicit transactions left open
Info
Detects sessions idle for minutes holding an open transaction (symptom of SET IMPLICIT_TRANSACTIONS ON).
Versions : 2012-2025