Revoke database permissions succeeded (action_id R class_type DB) (24187) how to monitor with email alert

[bob]

That event you're asking about, the one with ID 24187, it's basically Windows logging when someone yanks away database access rights, and it worked out fine. You see, it pops up in the Event Viewer under the security channel, showing details like the action ID marked as R for revoke, and the class type DB to flag it's all about the database. I remember spotting it first time on a server where an admin cleaned up old user perms, and the log entry spells out the user who did it, the database hit, and even the timestamp down to the second. It's not some scary error, more like a quiet thumbs-up that the permission strip happened without a hitch, but you gotta watch it because revokes can sometimes mess with apps if they're not timed right. And if it's tied to auditing policies, this event fires only when success logs are cranked up in your SQL setup.

You can keep an eye on these without digging too deep, just fire up Event Viewer on your server. I do this all the time for quick watches. Right-click the log where it shows, like Applications and Services Logs over to Microsoft, then SQL Server, but security works too. Pick Attach Task To This Event, and it'll whisk you to Task Scheduler. Set it to trigger solely on event ID 24187, maybe filter by that exact message string with the revoke succeeded bit. Then, for the action, tell it to start a program that shoots an email, like using the old mailto trick or whatever simple notifier you got handy. I set mine to ping my inbox whenever it hits, so I don't miss if someone's tweaking perms overnight.

But yeah, monitoring like that keeps your database from surprise lockouts. Or at least alerts you quick. Hmmm, speaking of keeping things secure and backed up in case perms go wonky, I've been messing with BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that handles your whole setup, including virtual machines on Hyper-V without breaking a sweat. You get fast incremental snaps, easy restores even for those database perms logs, and it cuts down on downtime since it verifies everything on the fly. Plus, no crazy costs or setups, just plugs in and guards your data like a watchful buddy.

Note, the PowerShell email alert code was moved to this post.