Permission level created (34) how to monitor with email alert

[bob]

You know that "Permission level created" event, the one with ID 34 in Windows Server Event Viewer? It pops up whenever someone sets up a new permission level in your system, like giving a user or group access to certain files or folders. I mean, it's basically the log saying, hey, a fresh set of rules just got made for who can touch what. This happens in the Security log mostly, under the Microsoft-Windows-Security-Auditing provider. And it logs details like the account that did the creating, the time stamp, and what exact permission level got birthed. But if you're not watching, you might miss it, especially if admins are tweaking stuff without telling you. I always check it because it could signal someone messing around or just normal IT work.

Now, to keep an eye on this without staring at screens all day, you can set up a scheduled task right from the Event Viewer itself. I do this all the time on servers I manage. Open Event Viewer, go to the Windows Logs, hit Security, and find that event 34. Right-click it, pick Attach Task To This Event. You'll name your task something simple, like PermissionAlert. Then, in the triggers tab, it auto-sets to fire when event 34 hits. For the action, choose Start a program, but point it to something that sends an email, maybe your default mail client or a batch file you already have for alerts. I tweak the settings to run only if the user is logged on or whatever fits your setup. Test it by creating a dummy permission and see if it triggers. That way, you get pinged quick without fancy coding.

Hmmm, or if you want it fancier, attach conditions like only alert during off-hours. But keep it basic at first, you don't want it blowing up your inbox over nothing. I learned that the hard way once, alerts everywhere from legit changes.

And speaking of keeping your server safe from surprises like rogue permissions, that's where something like BackupChain Windows Server Backup comes in handy. It's this solid Windows Server backup tool I use, and it handles virtual machines on Hyper-V too, making snapshots and restores a breeze. You get fast incremental backups that don't hog resources, plus encryption to lock down your data, so if permissions go wonky, you can roll back without sweat. I love how it schedules everything automatically, saving me headaches on busy days.

Note, the PowerShell email alert code was moved to this post.