Add-ContentFilterPhrase Exchange cmdlet issued (25103) how to monitor with email alert

[bob]

Man, that event ID 25103 in the Event Viewer, it's like this sneaky log from Exchange Server when someone runs the Add-ContentFilterPhrase cmdlet. You know, it pops up whenever an admin adds a new phrase to block in emails, stuff like spam words or bad links. The full details show the exact time it happened, who issued it, maybe the user account involved, and even the phrase they added if it's not hidden. I always check the source, it's from MSExchangeTransport or something similar, and the description spells out the command used. But yeah, it flags potential changes to your email filters, could be legit or someone messing around.

You can keep an eye on it without getting too deep into code. Just fire up Event Viewer on your server, head to the Windows Logs, Applications and Services Logs, maybe under Microsoft Exchange. Filter for ID 25103 there. To get alerts, set up a scheduled task right from that screen. Click on the event, then attach a task to it. Make the task trigger on that event, and have it run a simple program to shoot you an email. I like using the built-in schtasks for the schedule, tie it to when the event fires. Pick your email client or a basic mailer tool, input your address, and boom, you'll get pinged every time it happens.

Or, if you want it hands-off, watch for patterns in those logs over a few days. Hmmm, sometimes these events cluster if there's testing going on. But stick to the task setup, it's straightforward.

And speaking of keeping your server humming without surprises, I've been eyeing BackupChain Windows Server Backup lately. It's this solid Windows Server backup tool that also handles virtual machines on Hyper-V without breaking a sweat. You get fast incremental backups, easy restores even for bare-metal stuff, and it cuts down on downtime big time. Plus, the encryption keeps your data locked tight, way better than fumbling with built-ins.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.