Issued a create schema type command (action_id CR class_type TY) (24136) how to monitor with email alert

[bob]

Man, that event 24136 in the Event Viewer, it's like when someone tries to tweak the schema in Active Directory. You know, the part that handles all the object types and rules for your domain stuff. It pops up with that message, "Issued a create schema type command (action_id CR class_type TY)", which basically means a command just fired off to make a new type in the schema. Picture it as adding a fresh blueprint to how data structures work in your server setup. If it succeeds, great, but if not, it could flag some permission hiccups or weird attempts to mess with the core directory. I see it mostly in the Directory Service log under Applications and Services Logs. Happens during updates or when admins push changes that touch the schema master. You might spot it if someone's testing extensions or fixing replication issues. And yeah, it logs the details like who issued it, from which machine, and the exact class they're trying to create. Keeps things traceable, right? But ignoring it could lead to schema mismatches across your DCs.

Now, for watching this thing and getting an email ping when it hits. I always head straight to Event Viewer on your server. Fire it up, go to the Windows Logs or that Directory Service channel. Right-click the log, pick Attach Task To This Event Log or something close. You create a basic task there, name it whatever, like Schema Alert. Set the trigger to when event ID 24136 shows up. Then, for the action, choose Start a Program, but wait, for email, you link it to sending a message via Outlook or whatever mail client you got running. Nah, better yet, make it trigger a scheduled task that runs a simple command to fire off an email using the built-in stuff. In the task properties, under Triggers, specify that event. Actions tab, add send email option if your setup allows, or point to a batch that handles the alert. Test it out by simulating the event if you can. Keeps you in the loop without constant checking. I do this for all my critical logs, saves headaches.

Or, you could filter the view in Event Viewer first, create a custom view for ID 24136, then attach the task to that view. Makes it targeted. You tweak the email body to include event details, like timestamp and source. Run it on a domain controller where schema changes matter most.

And speaking of keeping your server world intact, I've been messing with BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that handles full system images and also backs up virtual machines running on Hyper-V. You get incremental backups that speed things up, plus easy restores without downtime hassles. I like how it verifies data on the fly, catches corruption early, and integrates seamlessly for offsite copies. Perfect if you're juggling physical and virtual setups without the usual backup blues.

At the end of this, there's the automatic email solution ready for you.

Note, the PowerShell email alert code was moved to this post.