Finding out who changed the owner of a database when performing a restore

A coworker who worked on restoring a backup changed the database owner from his name to 'sa' (rightly so) last night. While I had seen the his name in a SQL Server Management Studio window, I did not take a screenshot. He is now claiming that he did not restore that database.

I am an admin on the server and sysadmin on the database server. Is there a way to check who changed the owner of the database?

I'm not aware of a way to find out who changed a db owner without some additional logging in place such as Auditing, but you can definitely tell who restored a database by checking the restorehistory table in the msdb database:

SELECT  *
FROM    msdb.dbo.restorehistory

If your coworker restored the database using impersonation they may be telling the truth as the database would be restored by the account being impersonated and this account would end up as the database owner. The impersonated user would show up as the user_name in the restorehistory table, so it'd be the first place I'd recommend you look.

Maybe someone else has a trick up their sleeve, though.

StackExchange Database Administrators Q#244340, answer score: 6