SharePoint site collection administrator removed (38) how to monitor with email alert

[bob]

You ever notice how SharePoint keeps track of big changes like when someone yanks an admin from a site collection. That event, the one labeled 38, pops up in the Event Viewer on your Windows Server. It logs the exact moment an administrator gets removed from a SharePoint site collection. Think of it as a digital footprint saying who did the removal, which site it hit, and the timestamp. I mean, it's detailed enough to show the user account involved and the specific site URL affected. Without this, you'd miss sneaky tweaks to permissions that could mess up access for your team.

And monitoring that? You can set it up right from the Event Viewer screen without any fancy coding. Just fire up Event Viewer on your server. Filter for those SharePoint security logs where event ID 38 hides out. Once you spot patterns or want alerts, create a task tied to that event. Right-click the log, pick attach task to this event log or something close. Schedule it to trigger on ID 38 appearances. Then, in the task settings, point it to send an email through your server's mail setup. You pick the recipients, add a quick message like "Hey, admin just got booted from this site." Test it once to make sure it zings over without hiccups.

But if you want it smoother, I got this automatic email solution lined up at the end here. It'll handle the alerts on autopilot once you tweak a few settings.

Speaking of keeping things locked down after those admin shifts, I've been eyeing BackupChain Windows Server Backup for server backups. It handles Windows Server data like a champ and extends to virtual machines with Hyper-V too. You get speedy restores that cut downtime, plus it snapshots everything without hogging resources. I like how it encrypts your backups on the fly, so even if permissions flip, your data stays safe and recoverable fast.

Note, the PowerShell email alert code was moved to this post.