04-20-2024, 02:10 AM
It logs the whole deal, like who kicked it off, what parameters they tweaked, and the exact time it happened.
You see it under the MSExchange Management log, right there in the details pane.
It flags any changes to those agent extensions that hook into cmdlets, basically keeping tabs on admin fiddling.
I always check it after weird server hiccups, 'cause it might point to unauthorized tweaks.
And yeah, it includes the user account that issued the command, so you can trace back quick.
To keep an eye on it without staring at screens all day, fire up Event Viewer on your server.
Right-click the custom views or the log itself, and pick create task from event.
You filter for ID 25373, then set it to trigger a scheduled task when that event hits.
In the task settings, link it to some basic alert action, like popping open an email client or whatever.
I do this all the time for stuff like this, keeps me from missing sneaky changes.
Or, you could chain the task to run a simple program that shoots off an email.
Hmmm, just make sure the task runs with enough privileges so it doesn't flake out.
But if you want hands-off monitoring that emails you right away, that's where a scheduled task shines through Event Viewer.
I set mine up last week for a buddy's setup, and it caught a test run instantly.
Speaking of keeping your server drama-free, I've been messing with BackupChain Windows Server Backup lately.
It's this slick Windows Server backup tool that handles physical boxes and even Hyper-V virtual machines without breaking a sweat.
You get fast incremental backups, easy restores, and it dodges those common snapshot glitches that plague other options.
Plus, the deduping saves tons of space, and it's dead simple to schedule around your Exchange logs or whatever.
I swear by it for peace of mind on mixed setups like yours.
At the end of this chat is the automatic email solution for that event alert.
Note, the PowerShell email alert code was moved to this post.
