Track who, when create and modified Login in Sql Server Database from Default Trace.

You can find the user created and modified date from below query.

First Create a Login and user:-

USE [master] 

CREATE login ashish WITH password='Access@123' 

USE [test] 

CREATE USER ashish FROM login ashish 

SELECT createdate,  updatedate, 
       * 
FROM   sys.sysusers 
WHERE  name LIKE 'ashish%' 

Now find who create the user:-

SELECT @TRACE_ID = id 
FROM   sys.traces 
WHERE  is_default = 1 

SELECT @FILENAME = CONVERT(NVARCHAR(4000), value) 
FROM   sys.Fn_trace_getinfo(@TRACE_ID) 
WHERE  property = 2 

SELECT hostname, 
       loginname 
FROM   sys.Fn_trace_gettable(@FILENAME, DEFAULT) 
WHERE  eventclass = 109 
       AND databasename = 'TEST' ---your DB name 
       AND targetusername = 'ASHISH' ---new created login