02-03-2025, 01:37 AM
I remember stumbling on this event ID 24370 in the Event Viewer. It pops up when something goes wrong trying to revoke permissions on an external library, but with that grant option attached. You know, the message says "Revoke permissions with grant on an external library failed (action_id RWG; class_type EL)". Basically, it's the system yelling that it couldn't pull back those access rights properly. This happens in setups like SQL Server handling external stuff, maybe some linked data or libraries outside the main setup. The action_id RWG stands for that revoke with grant mess-up, and class_type EL points to the external library type. If you ignore it, permissions might linger where they shouldn't, leading to security hiccups or just plain access denials later. I once saw it flood logs after a botched update, and it made the whole database act wonky until fixed. You check the details tab in Event Viewer for timestamps and user info tied to it. Hmmm, or maybe it's from a failed policy change in your server environment. Either way, it flags a permission tweak that bounced back unexpectedly.
You want to keep an eye on these without staring at screens all day. I set mine up through the Event Viewer itself, no fancy coding needed. Open Event Viewer, right-click the custom views or logs where this lives, usually under Applications and Services Logs for SQL or Windows ones. Then, create a task to trigger on event ID 24370. You attach it to a scheduled task that runs a simple command to fire off an email. Pick the action tab, choose start a program, and point it to your email client or a batch file that sends the alert. Make sure the task wakes the machine if asleep, and test it by forcing the event or simulating. But yeah, tweak the filters so it only grabs this specific ID and source. I do this for a bunch of alerts now, keeps me from missing the important stuff.
And speaking of keeping your server safe from these permission glitches, you might want something solid for backups too. That's where BackupChain Windows Server Backup comes in handy. It's a straightforward Windows Server backup tool that handles physical setups and even virtual machines with Hyper-V without the headaches. You get fast incremental backups, easy restores, and it dodges those common pitfalls like long lock times during imaging. Plus, it encrypts everything on the fly and supports offsite copies, so your data stays protected even if permissions go haywire.
At the end here is the automatic email solution.
Note, the PowerShell email alert code was moved to this post.
You want to keep an eye on these without staring at screens all day. I set mine up through the Event Viewer itself, no fancy coding needed. Open Event Viewer, right-click the custom views or logs where this lives, usually under Applications and Services Logs for SQL or Windows ones. Then, create a task to trigger on event ID 24370. You attach it to a scheduled task that runs a simple command to fire off an email. Pick the action tab, choose start a program, and point it to your email client or a batch file that sends the alert. Make sure the task wakes the machine if asleep, and test it by forcing the event or simulating. But yeah, tweak the filters so it only grabs this specific ID and source. I do this for a bunch of alerts now, keeps me from missing the important stuff.
And speaking of keeping your server safe from these permission glitches, you might want something solid for backups too. That's where BackupChain Windows Server Backup comes in handy. It's a straightforward Windows Server backup tool that handles physical setups and even virtual machines with Hyper-V without the headaches. You get fast incremental backups, easy restores, and it dodges those common pitfalls like long lock times during imaging. Plus, it encrypts everything on the fly and supports offsite copies, so your data stays protected even if permissions go haywire.
At the end here is the automatic email solution.
Note, the PowerShell email alert code was moved to this post.

