What’s the issue?
Server level triggers, also known as DDL triggers or logon triggers, fire in response to events at the SQL Server instance level rather than within a specific database.DDL triggers can respond to events such as database creation, login creation, or permission changes, while logon triggers fire each time a user establishes a session. They are often created to enforce security policies, audit administrative actions, or restrict connections based on criteria such as source application or time of day.
This finding flags instances where one or more server level triggers are currently enabled.
Why is this a problem?
Server level triggers are not inherently bad, but they execute on every qualifying event and can have outsized impact if poorly designed.A logon trigger with inefficient logic runs for every single connection attempt, adding latency to every login and potentially locking out all users, including administrators, if it contains an error. A DDL trigger that raises an exception can block legitimate administrative work, and a trigger that writes to a table can cause cascading failures if that table becomes unavailable.
Forgotten triggers from past audits or security initiatives are particularly risky because they continue executing long after the original requirement has ended, and their presence may not be obvious to DBAs troubleshooting unrelated issues.
What should you do about this?
Identify active server level triggers by querying sys.server_triggers and reviewing the is_disabled column. Examine the definition of each trigger using sys.server_trigger_events and OBJECT_DEFINITION() to understand what events it fires on and what logic it runs.Review with your security team and application owners to confirm each trigger is still required, and retire any that no longer serve a purpose using DROP TRIGGER [TriggerName] ON ALL SERVER;. For triggers that must remain, ensure the logic is efficient, handles errors gracefully without blocking legitimate activity, and does not depend on resources that could become unavailable.
Always test changes to logon triggers carefully, and know how to connect using the dedicated administrator connection (DAC) in case a faulty trigger prevents normal logins. Document all server level triggers with their purpose, owner, and review date so they remain visible to the team.