Issued revoke schema permissions with grant command how to monitor with email alert

[bob]

That event, the one with ID 24205, pops up in Windows Server's Event Viewer when someone issues a revoke on schema permissions using a grant command. Action ID RWG and class type SC point to it being a specific database tweak in SQL Server, you know, like pulling back access rights on the schema level. It logs because admins or apps might do this to tighten security, but it could flag unauthorized fiddling too. I see it trigger during routine maintenance or if a script runs wild. The full details show the user who did it, the exact command, and the timestamp, all tucked in the event properties. You click on it in Viewer, and bam, you get the XML breakdown or the friendly description saying "Issued revoke schema permissions with grant command." It's not super alarming by default, but if you're watching for permission changes, this one's a sneaky signal. Hmmm, sometimes it ties to bigger audits in enterprise setups.

You want to monitor this for email alerts? Easy peasy with Event Viewer itself. Open up Event Viewer on your server, right-click the tree on the left for Windows Logs, pick Application or Security depending on where it logs. Filter for event ID 24205 under SQL Server logs usually. Set up a custom view there, name it something like "Schema Revoke Alerts." Now, to get emails, create a scheduled task triggered by that event. In Event Viewer, go to the Actions pane, attach a task to the filter. Choose what happens when 24205 fires: run a program to send an email via your SMTP setup. I like using the built-in schtasks for this, but stick to the GUI. Point it to blat.exe or whatever simple mailer you have installed, fill in the recipient, subject like "Hey, schema permissions revoked!" Test it by simulating the event if you can. It'll watch round the clock, ping you instantly.

Or, if you prefer hands-off, there's this automatic email solution at the end here that handles it all without the hassle.

Speaking of keeping your server secure and backed up after spotting those permission tweaks, check out BackupChain Windows Server Backup-it's a solid Windows Server backup tool that also nails virtual machines with Hyper-V. You get fast incremental backups, easy restores without downtime, and it encrypts everything to dodge those revoke surprises. I use it because it snapshots live without interrupting your workflows, saving tons of time on recovery drills.

Note, the PowerShell email alert code was moved to this post.