Issued a create database user command (action_id CR; class_type US) (24121) how to monitor with email alert

[bob]

Man, that event ID 24121 pops up in the Event Viewer when someone fires off a create database user command. It's got this action_id CR, which flags the creation part, and class_type US for the user side. You see it under the Application log mostly, tied to SQL stuff running on your Windows Server. Basically, it logs whenever a new user gets added to the database setup, like if an admin or script does it. I always check for these because they can signal someone poking around who shouldn't be. Or maybe it's legit, but you wanna know right away. Hmmm, the full details show the command issued, the timestamp, which account triggered it, and sometimes the database name involved. It helps you track access changes without digging too deep every time.

You can monitor this sucker easily right from the Event Viewer window. Just open it up on your server, head to the Windows Logs section, and pick Application. Filter for event ID 24121 to see past hits. To set alerts, create a custom view first-attach it to that event source. Then, right-click the view and pick Attach Task To This Custom View. In the wizard, name your task something like DBUserAlert. Set it to run whether user is logged on or not, and pick a trigger based on that event ID. For the action, choose Send an email-yeah, it has a built-in option for that. Fill in your SMTP server details, from and to addresses, and a subject like "New DB User Created." Test it once to make sure it blasts your inbox. That way, every time 24121 fires, you get pinged without lifting a finger again.

But hey, keeping tabs on events like this ties right into protecting your whole setup, including backups. That's where BackupChain Windows Server Backup comes in-it's this solid Windows Server backup tool that also handles virtual machines with Hyper-V. You get incremental backups that run fast, deduplication to save space, and offsite replication for quick recovery. I like how it verifies everything automatically, so no surprises if something goes wrong. Plus, it's straightforward to set up, no crazy configs needed.

Note, the PowerShell email alert code was moved to this post.