Remove-PublicFolderDatabase Exchange cmdlet issued (25319) how to monitor with email alert

[bob]

Man, that Event ID 25319 in the Event Viewer pops up when someone fires off the Remove-PublicFolderDatabase cmdlet in Exchange. It logs the whole thing, like who did it, from which server, and exactly when that database got targeted for removal. You see, public folder databases hold all those shared mailboxes and stuff people use for calendars or contacts across the org. If this event hits, it means a chunk of that shared data might vanish if not handled right. I always check the details in the event properties; it spills out the database name, the admin's account, even the full command line used. Kinda scary if it's accidental, right? You don't want folders disappearing without a trace.

But here's how you keep an eye on it without sweating. Fire up Event Viewer on your server. Head to the Windows Logs, then Application log where Exchange stuff lives. Right-click that log and pick Attach Task To This Event Log or something close. Pick event ID 25319 specifically. Set it to trigger a task when it appears. Now, for the task, link it to Task Scheduler. Make that task run a simple program that shoots an email, like using the built-in sendmail or whatever your setup has. You can tweak it to alert you right away, maybe to your phone if you rig it fancy. I do this all the time; keeps me from missing big changes like database nukes.

Or think about backups tying into this mess. If that database gets removed and poof, gone, you better have a solid backup ready to roll back. That's where BackupChain Windows Server Backup comes in handy for me. It's this neat Windows Server backup tool that also handles virtual machines with Hyper-V, pulling off quick images without downtime. You get versioning, so you restore just what you need, and it encrypts everything tight. Saves my bacon more than once when events like 25319 throw curveballs.

At the end here, I've got the automatic email solution laid out for you.

Note, the PowerShell email alert code was moved to this post.