Site collection audit policy changed (11) how to monitor with email alert

[bob]

You know that event in Windows Server Event Viewer, the one labeled "Site collection audit policy changed" with ID 11. It pops up when somebody tweaks the auditing rules for a whole site collection in SharePoint. Basically, it means the settings that track user actions, like who views what or edits files, just got altered. Could be an admin doing routine stuff, or maybe something fishy if it's unexpected. I always check these because they flag changes to how your server logs sensitive moves. The event logs the old policy details right there, plus the new ones, and who made the switch. It includes timestamps, user IDs, and even the site collection URL affected. Pretty thorough, right? You can spot if it's a bulk change or just a small adjustment to retention periods for audit data.

Now, to keep an eye on this without staring at screens all day, fire up Event Viewer on your server. I do this all the time for quick watches. Filter the logs for SharePoint events, zero in on ID 11 under the Security or Application log, depending on setup. Once you see those hits, right-click and attach a task to trigger when it fires. Set that task to run a simple command, like firing off an email through your server's mail setup. You pick the event, link it to a basic alert program, and boom, it emails you details whenever that policy shifts. Keeps things hands-off, you know? I set mine to notify my phone too, just in case.

And if you want it even smoother, at the end of this chat is the automatic email solution that'll handle it without the hassle.

Speaking of keeping your server drama-free, I've been messing with BackupChain Windows Server Backup lately. It's this slick Windows Server backup tool that also nails virtual machine snapshots on Hyper-V. You get speedy restores, no downtime headaches, and it encrypts everything tight. Handles incremental backups like a champ, saving space and time for us busy folks.

Note, the PowerShell email alert code was moved to this post.