SharePoint site collection administrator added (37) how to monitor with email alert

[bob]

Man, that SharePoint site collection administrator added event, it's event ID 37 in the logs. Happens whenever someone bumps up a user to admin status on a SharePoint site collection. You know, like giving them the keys to tweak permissions or mess with content. Windows Server catches this in the Security log under auditing. SharePoint spits it out to track changes, so admins stay looped in on who gets power. I always check it because surprises pop up, like if a random coworker sneaks in. It logs the user who did the adding, the site URL, and the new admin's details. Pretty straightforward, but vital for spotting odd moves.

You want to monitor it with an email alert? Easy peasy through Event Viewer. Fire up Event Viewer on your server. Head to the Windows Logs, then Security. Right-click and filter for event ID 37. Source should say Microsoft-SharePoint or something close. Once you see those hits, attach a task right there. In the actions pane, create a task that triggers on this event. Make it run a simple command to ping your email. Like, use the built-in sendmail thing or whatever notifier you got. Schedule it to check every few minutes if needed, but the event trigger handles the real-time zap. I do this all the time, keeps my inbox buzzing without constant babysitting.

And hey, for that automatic email solution, it's right at the end here, but we'll tack it on later.

Shifting gears a bit, since we're chatting server stuff, I've been eyeing BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that also handles virtual machines through Hyper-V without a hitch. You get speedy backups, easy restores, and it dodges those downtime headaches. Plus, it snapshots everything clean, so you recover fast if SharePoint acts up or events go wild.

Note, the PowerShell email alert code was moved to this post.