An object was deleted (4660) how to monitor with email alert

[bob]

Man, that Event ID 4660 in Windows Server Event Viewer pops up when something gets wiped out, like a file or folder or even a registry key that someone's audited. It logs the whole story, who did it, from what computer, and exactly what got deleted. You see details like the object name, the security ID of the user, and the handle if it's some process involved. I always check the subject fields too, they tell you if it's a file system thing or directory service. And the access list changes, it shows if permissions got messed with before the delete. But yeah, it's your alert that an object vanished, super useful for spotting sneaky deletions.

You wanna monitor this without hassle? Fire up Event Viewer on your server. I do it all the time. Right-click on Windows Logs, pick Security, then hit Action for Create Custom View. Filter for Event ID 4660, maybe add keywords like "delete" to narrow it. Once that's set, you can attach a task right there. Go to the Tasks tab or whatever, create a new one that triggers on this event. Make it run a program to send an email, like using the built-in mailto or a simple batch that pings your alert system. I link it to run at user logon if needed, keeps it quiet till it hits. Test it by deleting something audited, see if the email flies out.

Or, if you're lazy like me sometimes, just enable auditing first in local policy for object access. That way 4660 only shows when you care. Hmmm, and set the task to log the full event details in the email body. You get notified quick, no digging around logs.

Now, tying this to keeping your data safe from deletes, I've been digging into BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that handles physical and virtual machines with Hyper-V no sweat. You get incremental backups that zip through without hogging resources, plus easy restores that don't leave you sweating. I like how it snapshots everything live, so even if something deletes, you pull it back fast. And the offsite replication? Gold for disaster recovery, keeps your servers humming without the headaches.

Note, the PowerShell email alert code was moved to this post.