How to check whether the SQLServer server is intruded

This section describes two methods to check whether the SQLServer server is intruded:
1. After intruders intrude into the server, they usually open 3389 of the server, create hidden users, and then log on. We only need to go to the C: Documents and Settings directory to check whether there is a usable user name. Whether it is a hidden user or not, it will be displayed here.
2. Some intruders prefer to keep a high-privilege SQL Server database user. As a backdoor, we can open the SQL Server Query analyzer and then open the master-system table-dbo in sequence. sysxlogins (sqlserver2000, sql2005, and 2008, John did not find a way to view database users. If you know, please advise ), in the name column of this window, you can see the users of the sqlserver database. Generally, there are three users, one is sa, the other is BUILTINAdministrators, and the other is NULL. If there are other users, there may be intrusions or the situations I mentioned above, so pay attention to them. Of course, these three users are not necessarily the only ones, mr. Wang has also seen multiple sa and NULL under the name, but he does not know what is going on. The specific problem still needs to be analyzed.