Permission level deleted (35) how to monitor with email alert

[bob]

You ever notice how Windows Server keeps a log of stuff changing in permissions? That "Permission level deleted" event, with ID 35, pops up when someone yanks a whole level of access rights from a file or folder share. It happens in the File Server Resource Manager part, where quotas and screening rules tie into those perms. Basically, if an admin or script removes a permission set, boom, this event fires off in the Applications and Services Logs under Microsoft, then Windows, FileServer, ResourceManager, Operational. It logs who did it, what share got hit, and the exact time, like a digital fingerprint on the change. Why care? Because losing a permission level could mean users suddenly can't access files they need, or worse, it opens doors for unauthorized tweaks if not watched. I always check these logs after updates, since they can sneak in during maintenance. And you know, ignoring them might lead to compliance headaches down the line.

Monitoring this beast for email alerts? Fire up Event Viewer on your server. Right-click the custom view or the specific log, pick Create Custom View. Filter for Event ID 35 in that ResourceManager operational log. Save it, then attach a task to it. In the Actions tab, create a scheduled task that triggers on this event. Set it to run a program like the old mailto command or whatever email client you got hooked up. Make the task send a quick alert to your inbox with details from the event. Test it by simulating a perm delete on a test share. That way, you get pinged right away without staring at screens all day. I do this for a few key events, keeps things chill.

Oh, and speaking of keeping your server drama-free, check out BackupChain Windows Server Backup if you're into solid backups. It's a neat Windows Server backup tool that handles physical setups and even Hyper-V virtual machines without a hitch. You get fast incremental backups, easy restores, and it runs light on resources, so no bogging down your system during ops. Plus, the encryption and versioning mean your data stays safe from mishaps like those perm glitches.

Note, the PowerShell email alert code was moved to this post.