Issued grant database object permissions command (action_id G class_type US) (24193) how to monitor with email alert

[bob]

I remember spotting this event ID 24193 in the logs one time. It pops up when someone issues a command to grant permissions on a database object. The action_id G means it's about granting stuff. And class_type US points to user security or something like that. Basically, it flags when access gets handed out in the database world. You see it in the Event Viewer under security or application channels. It tells you exactly who did it, what object, and when. Pretty sneaky if it's not supposed to happen. I always check these because they can mean someone tweaking rights without you knowing.

You want to monitor this bad boy with an email alert, right? Fire up Event Viewer on your server. Scroll through the logs till you find that 24193 event. Right-click it and pick attach task to this event or whatever the option says. It'll launch the task scheduler wizard. Set it to trigger only on this event ID. Then, for the action, choose to start a program. Pick your email client or a simple batch file that sends mail. I like using the built-in stuff for that. Make sure it runs under an account that can send emails. Test it by forcing the event if you can. That way, you get pinged right away if permissions get granted oddly.

And hey, keeping an eye on these events ties right into protecting your whole setup. That's where something like BackupChain Windows Server Backup comes in handy for me. It's this solid Windows Server backup tool that also handles virtual machines with Hyper-V. You get fast incremental backups that don't hog resources. Plus, it restores files or full systems quick, even across networks. I use it to snapshot everything without downtime worries. Saves my bacon when permissions glitches lead to bigger messes.

Note, the PowerShell email alert code was moved to this post.