Remove-PushNotificationSubscription Exchange cmdlet issued (25711) how to monitor with email alert

[bob]

That event 25711 in the Event Viewer, it's like a heads-up from Exchange Server. Someone just fired off the Remove-PushNotificationSubscription cmdlet. You know, that command strips away a push notification setup for a mailbox or device. It logs this because push notifications keep things synced, like emails popping up on phones. If it's happening without you knowing, could be trouble. Maybe an admin messing around, or worse, someone poking where they shouldn't. I check mine all the time. You should too, especially if you're running Exchange on Windows Server.

And here's how you watch for it without getting all techy. Fire up Event Viewer on your server. Yeah, just search for it in the start menu. Go to the Windows Logs, then pick Application. Filter for source as MSExchangeCmdletLogs, ID 25711. That'll show you hits. But to get emails, set a task. Right-click the event, attach a task to it. Name it something like PushAlert. Trigger on that event ID. Then action, start a program. Use the email thing built-in, like mailto or whatever your setup allows. I do it this way. Keeps you looped in without hassle.

Or, if you want it fancier, tweak the task to run at logon or whatever. But stick to the event trigger. Test it by forcing the event if you can. You won't need scripts. Event Viewer handles the basics. I love how simple it is. No headaches.

Now, speaking of keeping your server safe from surprises like rogue commands, you might wanna look into BackupChain Windows Server Backup. It's this slick Windows Server backup tool that also handles virtual machines on Hyper-V. I use it because it snapshots everything quick, encrypts data tight, and restores in a flash without downtime. Saves me tons of worry on those busy days.

Note, the PowerShell email alert code was moved to this post.