Alabama Life and Casualty Insurance Corporation specializes in underwriting commercial farm policies throughout the southern United States. The companys chief information officer has become increasingly concerned that one of the companys recent hires, a tech-savvy actuary, is directly accessing several production SQL Server databases using unapproved tools and access methods. Before approaching the employees supervisor, he has asked you, as the database administrator, to gather some additional information on the client application, network protocol, and queries that he believes the actuary is using on a routine basis. Your SQL Server 2012 instance is configured for Windows Authentication only and you manage role security using Active Directory. The database server is only accessible from within the local area network (LAN), and no firewalls are present between the server and client applications.

Describe the potential pitfalls you envision in trying to execute this plan.

Explain which data elements you think will be most challenging to capture, and why.