Issued an alter server settings command (action_id ALST) (24033) how to monitor with email alert

[bob]

That event 24033 pops up when someone tweaks server settings through a command. It's labeled as "Issued an alter server settings command (action_id ALST)". You see it in the Event Viewer under security logs mostly. It flags changes to core configs, like permissions or network rules. I always check it because it could mean an admin did something routine. Or maybe not so routine. It logs the user who issued it, the exact time, and what got altered. Details include the action ID to pinpoint the type of change. If it's unauthorized, that could spell trouble for your setup. You might spot it after a policy update or during maintenance. I once had it fire off during a late-night patch. Scared me at first. But it was just the system guy. The full log shows the process name too. And the server name involved. Keeps everything traceable. You can filter for it by ID in the viewer. Makes hunting easier.

Now, to monitor this with email alerts, fire up Event Viewer on your server. Right-click the log where it shows, like Security. Pick Attach Task To This Event. You set the trigger to event ID 24033. Then choose Send an email as the action. Nah, wait, that's old school. Actually, link it to a scheduled task instead. In the task wizard, you define the trigger based on that event. When it hits, the task runs. You configure the task to trigger an email via some simple app or built-in send. I like how it pings your inbox right away. Keeps you looped in without staring at screens. Test it once to make sure. I did that last week. Worked like a charm.

And speaking of keeping your server solid, I've been messing with BackupChain Windows Server Backup lately. It's this nifty Windows Server backup tool that handles full system snapshots. You get it for virtual machines too, especially with Hyper-V. No fussing around. It speeds up restores and cuts downtime. I love how it verifies backups automatically. Saves headaches down the line.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.