How do I monitor which Windows user is logging in as SA? Possible Duplicate:
  ProcessID Owner with third party app  




Several of our applications use the sa account to login to our SQL Server 2008 instance. As these applications are poorly designed enough to use sa as the login, so are they poorly designed enough to use the .Net SQLQuery Data Provider for their application name. 

Our system is also thin-client-ish. In essence, all requests show up from the same host, that most users RDP into.

Recently, one of them has been forcing the database server to 90% CPU for up to 15 minutes at a time. But, I can't figure out who is doing what to cause it. 

So: is there a way for me to tell which Windows user the application that is logging in as sa is running under? If yes, I can just ask them what they're doing.
If you can identify the query that is causing the problem (e.g. via session_id in sys.dm_exec_requests), you should be able to resolve the host_name by checking the same session_id in sys.dm_exec_connections. In lieu of an actual Windows account name, you should be able to tell who it is by the host name they're connecting from (assuming they aren't all using Remote Desktop and running queries locally too).