05-11-2024, 09:10 PM
It's like the system says no to revoking that grant on the scoped thing, with action_id RWG and class_type DC.
You see it in the Event Viewer under security logs, right?
It means a user or process couldn't pull back those access rights properly.
Frustrating, huh?
I once chased this ghost for hours on a client's server.
The full scoop is it logs a failure in altering database credentials, specifically revoking with grant options.
That credential ties to a database only, not server-wide.
If it fails, your security setup might have holes.
You gotta watch for it to keep things tight.
Now, to monitor this with an email alert, fire up Event Viewer on your Windows Server.
I do this all the time for quick heads-ups.
Click on the event logs, find the one with ID 24352.
Right-click it, pick Attach Task To This Event.
You'll build a scheduled task right there in the wizard.
Name it something like CredentialFailAlert.
Set the trigger to when that exact event ID hits.
For the action, choose Send an email.
You fill in your SMTP server details, from and to addresses.
Test it out to make sure it pings your inbox.
Boom, every time it fails, you get notified without lifting a finger again.
And hey, if you're dealing with server mishaps like this, you might want a solid backup in play.
That's where BackupChain Windows Server Backup comes in handy for me.
It's this neat Windows Server backup tool that handles physical machines and virtual ones too, especially with Hyper-V.
You get fast incremental backups, easy restores without downtime, and it encrypts everything to keep data safe from prying eyes.
Saves you headaches when events like 24352 signal trouble brewing.
At the end of this, there's the automatic email solution waiting for you.
Note, the PowerShell email alert code was moved to this post.
