Member Avatar for Takuniku

I know we can go to the audit log to check who access the server but I would like to know how to configure my window server 2008 to send an push notification email or SMS immediately if it detect any unauthorised users trying to login or failed login attemps.

Any website I can read up on?

  • 3 Contributors
  • 2 Replies
  • 213 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

Quick summary for (and following ’s OS question): the simplest reliable approach on Windows Server 2008/R2 is to enable logon auditing, then attach a Task Scheduler task to the Security event for failed logons (event 4625) that runs a script to send an alert. ’s pointer to attaching tasks to event logs is correct, but a few extra steps and cautions are needed to make it useful and safe in production.

Steps (high level): enable auditing for "Account Logon" / "Logon" failures in Local Security Policy or Group Policy so 4625 entries are generated; open Task Scheduler → Create Task → Triggers → "On an event" → Log: Security, Source: Microsoft‑Windows‑Security‑Auditing, Event ID: 4625; set the Action to "Start a program" that runs a PowerShell/script which sends mail or calls an SMS/push API. Don’t rely on Task Scheduler’s built‑in “Send an e‑mail” action—use a script so credentials and TLS can be handled correctly.

Operational notes and cautions: the alert script must run under an account with network access and securely stored credentials (use Windows Credential Manager or an encrypted file with tight ACLs). Avoid alert storms: aggregate or threshold alerts (for example, alert only after N failures from the same account/IP in M minutes) or forward events to a central collector / SIEM. For SMS consider carrier email‑to‑SMS gateways or an HTTP API (Pushbullet, Pushover, Twilio, or corporate SMS gateway); email‑to‑SMS can be unreliable and may truncate messages.

Testing & troubleshooting: generate a controlled failed login, confirm 4625 appears in Event Viewer, check the Task Scheduler History (enable history), and inspect the script’s logs. Verify firewall/SMTP/API access and that messages aren’t being dropped as spam. For any environment with many servers, use Windows Event Forwarding or a log management system to avoid per‑server scripts and to get better correlation and rate control.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

What operating system are you running? Windows, or Linux?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.