Monthly security audit checklist for your MU server

MU Online server security is not a state you reach and forget; it is a process that degrades on its own over time. Each month new members join the team, old accounts get forgotten with active privileges, patches stop being applied, backups silently stop running, and the game economy accumulates small anomalies. A monthly security audit is the ritual that reverses this entropy: a repeatable step-by-step process that reviews each layer of the server and returns the configuration to a known-good secure state.

This tutorial delivers a complete and practical monthly audit process, organized by area, for you to run the same way every time and compare month over month. The standardization is what gives it value: when you audit the same way every time, any deviation jumps out. The commands and table names are EXAMPLES and vary by season/emulator (Season 6, IGCN, MuEMU, X-Files, and others) and by operating system; adapt them to your stack. The goal is not to memorize commands, but to have a routine that no one forgets to follow.

Prerequisites

To run the audit you need:

1. Administrative access to the server machine and the database.
2. A documented baseline of the normal state (accounts, ports, services, size of the economy). If you don't have one yet, the first audit will create it.
3. A secure, versioned place to store the reports from each audit.
4. Access to login logs, GM command logs, and operating system logs.
5. A reserved and recurring time window on the calendar (for example, the first Monday of the month).

Treat the audit as a fixed commitment. Audits done "whenever there's time" never happen.

How to use this process

The audit is divided into six areas: accounts and access, database, network and system, backups, game economy, and incident response. Go through the sections in order, checking off each item. At the end, record a short report with the date, who ran it, what was outside the baseline, and the actions taken. Keep all the reports; the historical series is what reveals trends (for example, patches that are systematically late or an economy inflating month over month).

Area 1 — Accounts and access

Access accumulation is the vulnerability that grows most over time. Review monthly:

1. List all staff accounts and confirm that each one still belongs to an active member. Remove former members.
2. Check that each account's privilege level still matches its role (avoid silent privilege escalation).
3. Confirm that 2FA is active on all administrative accounts.
4. Review database and operating system accounts looking for orphaned or generic users.
5. Check service passwords that have never been rotated.

Example query to list accounts with elevated privileges (adapt the level column name):

SELECT AccountID, CtlCode, LastLoginIP
FROM MEMB_INFO
WHERE CtlCode >= 8   -- EXAMPLE of GM/admin level; varies by emulator
ORDER BY AccountID;

Compare the result with the baseline. Any new administrative account you don't recognize is grounds for immediate investigation.

Area 2 — Database

The database holds accounts, items, and the entire economy; compromising it is compromising the server. Review:

1. Confirm that the SQL Server port is not exposed to the internet.
2. Check that the sa account is disabled or has a strong, rotated password.
3. Check that each application uses a least-privilege user, not an administrative account.
4. Review the permissions granted in the last month.
5. Confirm that the database audit logs are active and being written.

Area 3 — Network and operating system

1. List the open ports and compare with the baseline. Close any port that shouldn't be open.

# Linux
ss -tulpn
# Windows (PowerShell)
Get-NetTCPConnection -State Listen | Sort-Object LocalPort

1. Confirm that operating system security patches were applied in the last month.
2. Review the firewall rules and remove temporary exceptions that became permanent.
3. Check whether unnecessary services were disabled.
4. Check remote access logs (RDP/SSH) for strange sources or unusual times.

Area 4 — Backups

Backups that aren't tested are not backups; they are hope. Every month:

1. Confirm that automatic backups ran on every expected day.
2. Verify the integrity of at least one recent backup.
3. Perform a real restore test in a separate environment (the most ignored and most important step).
4. Confirm that a copy exists offsite from the main server, protected against ransomware.
5. Review the retention policy and whether it still meets your needs.

Area 5 — Game economy

The economy audit detects item duplication, exploits, and bots that go unnoticed day to day:

1. Compare the total zen in circulation with the previous month's. Abnormal growth suggests duplication.
2. Check the number of high-value excellent and ancient items generated in the period.
3. Check the number of resets per account looking for automated patterns (bots).
4. Review Web Shop transactions and cross-check them with the actual payments received.
5. Investigate accounts with wealth disproportionate to their play time.

Area 6 — Incident response and documentation

1. Review the month's security incidents and confirm that each one was closed.
2. Update the baseline if there were legitimate changes (new staff account, new required port).
3. Check whether the incident response plan is still correct and accessible to the team.
4. Confirm that the emergency contacts (host, team) are up to date.

Summary table of the audit areas

Complementary frequency table

The intervals above are an EXAMPLE starting point and vary according to the size of the server, its criticality, and the size of the team. Larger servers tend to shorten these cycles.

Common errors and fixes

How to keep the process alive

A monthly audit only works if it is repeatable and doesn't depend on a single person. Document each step in a routine that another team member can follow on their own. Automate whatever you can (collecting open ports, listing accounts, checking backups) so the manual work focuses on interpretation, not collection. Schedule the audit on the calendar as a fixed commitment and always produce the final report, however short it may be. The accumulated history is, in itself, one of the most valuable security tools you will have.

Launch checklist

• Baseline documented and accessible
• Recurring monthly window scheduled
• Staff accounts reviewed and former members removed
• 2FA confirmed on all administrative accounts
• Database port closed and sa protected
• Open ports compared with the baseline
• Operating system patches applied
• Backups verified and restore tested
• Offsite copy confirmed
• Economy compared with the previous month
• Web Shop transactions cross-checked with actual payments
• Month's incidents closed and documented
• Audit report saved and dated

Auditing every month turns security from a reactive event into a preventive habit. If you are structuring the server now, align this process from the start, together with the foundation described in the how to create an MU Online server guide. A regularly audited server is rarely caught off guard; and in MU Online, avoiding surprises is half the battle.

Frequently asked questions