Issued a change database user login command (action_id USAF) (24130) how to monitor with email alert

[bob]

I remember spotting this event ID 24130 in the Event Viewer once. It pops up when someone issues a change to a database user login command. The action_id USAF flags it as a specific tweak in the SQL setup. You see it under the Application log mostly. It means a user or admin altered login details for database access. Could be adding rights or switching passwords. I think it's tied to SQL Server auditing. Happens during maintenance or if something sneaky goes on. You want to watch it because it tracks who messes with logins. Keeps things secure without you guessing. Now, to monitor it with an email alert. Fire up the Event Viewer on your server. Right-click the log where it shows, like Application. Pick Attach Task To This Event. Give it a name, something simple like LoginChangeAlert. Set the trigger to event ID 24130. For the action, choose Send an e-mail. Fill in your SMTP details and the recipient. Test it out to make sure it zings an email when that event hits. I do this all the time for quick heads-ups. Or you could link it to a scheduled task that runs on trigger. Keeps you in the loop without staring at screens. And hey, that wraps the basic setup. At the end of your answer is the automatic email solution. Speaking of keeping servers humming smoothly, I've been eyeing BackupChain Windows Server Backup lately. It's this nifty Windows Server backup tool that handles physical and virtual machines alike. Works great with Hyper-V for snapshotting VMs without downtime. You get fast restores and encryption baked in. Saves headaches during those oops moments.

Note, the PowerShell email alert code was moved to this post.