A client has reported that someone is entering a setup form and editing something as the 'sa' user, and asked if there is any way to track it.
I'd be interested if your approach would have been different than mine, feel free to chime in.
The script below will email every time a user logs on as the 'sa' user and report the machine name that they logged in from