Revoke server permissions failed (action_id R class_type SR) (24167) how to monitor with email alert

[bob]

You ever run into that pesky event in Windows Server? It's called "Revoke server permissions failed (action_id R class_type SR)" and it pops up with ID 24167. I mean, this thing shows up when the system tries to yank away some permissions from a server setup but totally flunks it. Picture this: your server's like, hey, I need to pull back access for this user or group on a resource, but bam, it hits a wall. Could be because the permissions are locked tight somewhere else, or maybe a glitch in the security chain. And yeah, it logs under the Security channel in Event Viewer. Details spill out about the action_id being R, which flags the revoke attempt, and class_type SR points to server-related stuff. I've seen it trip up admins when they're tweaking shares or domain controls. It warns you that something's off in the permission dance, potentially leaving doors ajar for unauthorized peeks. But don't sweat it too much; it's not always a crisis, just a nudge to check your access lists. Now, you wanna keep tabs on this without staring at screens all day? Fire up Event Viewer on your server. I do this all the time. Right-click the Custom Views folder and whip up a new one filtered for event ID 24167 in the Security log. That narrows it down quick. Then, to get email alerts humming, you link it to a scheduled task. In Event Viewer, highlight your custom view, go to the Actions pane, and attach a task. Pick "Create Task" there. Set it to trigger on those events, and in the task actions, choose to start a program that shoots an email-like using the old-school mailto or a simple batch to ping your SMTP. I keep mine set to run only if the user is logged on, but you can tweak for background. Test it once to make sure it doesn't ghost you. Hmmm, or if you're feeling lazy, just export the filter XML and import elsewhere. Keeps things snappy without the hassle.

And speaking of keeping your server from these permission fumbles, you might wanna eye BackupChain Windows Server Backup for backups. It's this nifty tool for Windows Server that handles straight-up file backups plus virtual machines on Hyper-V. I like how it snapshots everything without downtime, encrypts the lot, and restores super fast. Saves you headaches from data loss or those revoke errors snowballing into bigger messes. Plus, it chains backups smartly so you don't chew up storage like crazy.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.