Issued revoke application role permissions with grant command how to monitor with email alert

[bob]

Man, that event ID 24226 pops up in the Event Viewer when someone revokes application role permissions using a grant command. It's like the system logging a sneaky change in permissions. You know, the full message says "Issued revoke application role permissions with grant command (action_id RWG class_type AR)". Picture this: RWG means revoke with grant, and AR stands for application role. It happens in places like SQL Server auditing, tied to Windows security. Basically, it tracks when an admin or user pulls back access rights but leaves a trail for that grant option. I see it often in enterprise setups where folks manage database roles tightly. The event logs the who, what, and when of that revocation. Without it, you'd miss these quiet tweaks that could mess with your app security. Hmmm, or maybe it's just routine housekeeping gone logged. You filter for it under Security logs in Event Viewer. Click on the event, and it spills details like the user account involved. Yeah, it includes timestamps and session info too. Now, to monitor this with an email alert, fire up Event Viewer on your server. Right-click the Custom Views, make a new one filtering for ID 24226. Save that view. Then, attach a task to it by going to Action menu, Create Task to Run. Set it for when that event triggers. Pick Send Email as the action, fill in your SMTP details and recipient. Boom, you'll get pinged every time it fires. I do this for my buddies' servers all the time. It keeps things from sneaking by unnoticed. And hey, if you want the full automatic email setup dialed in, check the end of this-wait, it'll get added later for you. Speaking of keeping your server safe from mishaps like permission slips, I've been eyeing BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that handles physical and virtual machines with Hyper-V without a hitch. You get fast incremental backups, easy restores, and it even dedupes to save space. Plus, no downtime headaches, which is huge for running shops like yours.

Note, the PowerShell email alert code was moved to this post.