Hi

In my DB (SQL 2012) one windows authentication is created automatically and a schema is created exactly automatically that this user is owner of this schema. (e.g the user is domain\x and schema exactly domain\x)

I created a DDL Trigger on my DB to find out who and how it is created , but I didn't get any useful information.

I change the owner of schema that I can delete the schema and after that delete the user, and sometimes because the user is owner of a service , I have to alter the owner of the service to DBO and delete the user , but again and again exactly this user and schema (e.g domanin\x ) are created as soon as I delete it.

I have read these topics :

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/0c4db82a-4b93-41d1-8e3a-786eaaac550f/can-a-user-be-automatically-added-to-a-database?forum=sqlsecurity

and 

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/f3280d73-2000-4d32-bff1-df8d138fefd2/users-automatically-added-to-new-db?forum=sqlsecurity

but can't solve my problem.

Dose anybody know why it's happened ? 

so, a domiain login is created on the server and it is being created again- even if you after dropped the login.

 can you create audit server audit-- and see how it is being created - you said, it is being right after you deleted the login

can you create a trace/extended event and check what's creating after you drop. should be easy if it is being created right after you dropped it..

if you do not know when it is being created - just use server audit - login created event(not excatly this).. it should tell you.

my guess, is some third party application - what is login looklike -- like service account/third party account.. can you network team throw some light on what the login is ??

So referring the answer in the first thread you posted a link to, have you checked if there are any objects in this schema, or any objects created by this user?

In my DB (SQL 2012) one windows authentication is created automatically and a schema is created exactly automatically that this user is owner of this schema. (e.g the user is domain\x and schema exactly domain\x)

Hello,

New databases are created as a copy of the system database "Model", so I guess this Windows login + schema already exists in this "Model" database and therefore in all new databases; so check your "Model" database.