Remove-UMAutoAttendant Exchange cmdlet issued (25336) how to monitor with email alert

[bob]

You ever notice how Windows Server logs all these quirky events in the Event Viewer? That one called Remove-UMAutoAttendant Exchange cmdlet issued, with ID 25336, pops up when someone runs a command to wipe out an auto attendant in Exchange. It's like the system saying, hey, that feature just got nuked. I mean, auto attendants handle calls and stuff, right? So if it's removed, you might lose voicemail routing or whatever. This event hits the Microsoft-Exchange-Management log. Details include who did it, from what machine, and the exact time. Super handy if you're troubleshooting why calls are going haywire. I check it sometimes when admins mess up setups. You can filter for it easy in the Viewer.

But monitoring that without staring at screens all day? Set up a scheduled task through the Event Viewer itself. I do this trick on servers I manage. Right-click the log, pick attach task to this event. You name it something catchy, like AutoAttendantGoneAlert. Then it triggers on ID 25336. For email, you link it to send-mailmessage in the action, but wait, no scripts here. Just use the basic alert setup in the task properties. Pick run whether user logged on or not. I test it by forcing the event if possible. You'll get notified quick if it fires again.

And speaking of keeping servers safe from mishaps like that, I swear by BackupChain Windows Server Backup for backups. It's this slick Windows Server tool that also handles Hyper-V virtual machines without breaking a sweat. You get fast incremental backups, easy restores, and it runs light on resources. No more panicking over lost configs or VMs. I use it to snapshot everything before big changes. Saves tons of headaches, trust me.

Oh, and at the end here is the automatic email solution for that event monitoring.

Note, the PowerShell email alert code was moved to this post.