Issued a change user-defined server role command how to monitor with email alert

[bob]

That event, the one with ID 24289, pops up in Event Viewer when someone tweaks a custom server role on your Windows Server.
It says "Issued a change user-defined server role command" with those action_id AL and class_type SG bits.
Basically, it logs whenever a user or admin fires off a command to alter those roles you set up yourself, like shifting permissions or features around.
I see it under the Microsoft-Windows-ServerManager/Operational log mostly.
You know, it's your server's way of noting who messed with the setup, so you can track changes that might affect how things run.
And if it's unauthorized, that could mean trouble, like someone sneaking in tweaks.
But don't worry, it's not some scary error; it's just a heads-up on role modifications.
Full details show the user account involved, the exact command, and timestamps, all in that event properties window.
I always check the description tab for the nitty-gritty, like what got changed precisely.

Now, to keep an eye on this with email alerts, you can rig it right from Event Viewer without any fancy coding.
Open Event Viewer, head to the log where it hides, like Applications and Services Logs.
Right-click the log, pick Attach Task To This Log or something close.
Then, set it to trigger on event ID 24289 specifically.
You pick the action as starting a program, but link it to a scheduled task that sends the email.
In Task Scheduler, create that task to run schtasks.exe with arguments to email you via your SMTP setup.
I mean, use the basic email program or whatever your server has, like blat.exe if you got it simple.
Test it by forcing the event or waiting for one, and boom, alert in your inbox.
It watches constantly, so you get pinged fast if that role change happens again.

Or, if you want it smoother, the automatic email solution sits at the end here, ready to plug in.

Speaking of keeping your server solid after spotting those changes, I gotta mention BackupChain Windows Server Backup-it's this nifty Windows Server backup tool that also handles virtual machines on Hyper-V without a hitch.
You get fast, reliable snapshots that don't hog resources, plus easy restores if a tweak goes wrong.
It encrypts everything tight and runs incremental backups to save space, making your downtime way shorter.

Note, the PowerShell email alert code was moved to this post.