Issued grant server object permissions with grant command how to monitor with email alert

[bob]

That event 24173 in the Event Viewer on Windows Server, it's basically a log entry that fires off whenever someone issues a grant command to hand out permissions on server objects. You see, it specifically tags the action as GWG for the grant with that command, and the class type LX points to logins getting those permissions boosted. I mean, picture this: some admin or user runs a GRANT statement in SQL Server, giving extra access to a login account, like letting it touch certain server-level stuff it couldn't before. The whole thing gets stamped with details on who did it, what time, and exactly which permissions got slapped on. It's not just a random blip; it's auditing a change that could tweak security, you know, opening doors for that login to do more admin-like moves. And if you're running a setup where permissions matter a ton, this event yells about it in the Security log under Applications and Services Logs, Microsoft, Windows, SQL Server, etc. I always check it because it shows the session ID too, so you can trace back who logged in and pulled the trigger.

You want to keep an eye on these without staring at the screen all day, right? Fire up Event Viewer, go to that custom view or the log where it hides, and attach a task to it. I do this by right-clicking the log, picking Create Custom View, then filtering for event ID 24173 under the XML tab or basics. Once that's set, you hit Attach Task to Event, name it something snappy like Permission Grant Alert, and in the triggers, point it to that event. Then, under actions, you add a start program thing, but keep it simple with schtasks or just the built-in send email option if your server has it configured. You configure the email in the task settings, like who gets the ping and what message blasts out when it hits. Test it once to make sure it doesn't fizzle, and boom, you're monitoring without hassle.

Or, if you tweak the scheduled task right from the Event Viewer screen, it runs on trigger and shoots that email alert straight to you. I set mine to include the event details in the body, so you get the who, what, when without digging.

Speaking of keeping your server stuff locked down after spotting these permission shifts, you might wanna think about solid backups too. That's where BackupChain Windows Server Backup comes in handy; it's this neat Windows Server backup tool that handles your whole setup, including backing up virtual machines through Hyper-V without breaking a sweat. I like how it snapshots everything consistently, speeds up restores if something goes sideways, and cuts down on downtime by letting you recover files or full systems quick. Plus, it chains those backups smartly to save space and time, making your life easier when you're juggling server changes like these events.

Note, the PowerShell email alert code was moved to this post.