How to automatically send e-mail when an error occurs in Event Viewer


  1. Posts : 46
    Windows 10 23H2
       #1

    How to automatically send e-mail when an error occurs in Event Viewer


    I'm IT responsable for a fews computers in an very small enterprise. I want to forward a event when a error occurs in Event Viewer. I'm relatevely new on this. There is anyway to automate this? Maybe a script on background when the error occurs.
      My Computer

  2.   My Computers


  3. Posts : 1,203
    11 Home
       #3

    Although the PowerShell script that is shown in Step 1 in the article linked by @vgchat should get the job done, a more moden approach (in PowerShell 2.0 and upper) is to use the Send-MailMessage cmd-let.
    Send-MailMessage: Sending Emails from PowerShell | Windows OS Hub
      My Computers


  4. Posts : 1,203
    11 Home
       #4

    Also, in Task Scheduler, on the Triggers tab of a task's Properties window, it is possible to enter a custom Event Filter if needed. Although the article linked below takes it an additional step further by also discussing how this can effectively be used in concert with Auditing, the part of the article that explains one example [of how it is possible to set up a custom Event Filter] might still be helpful to you for what you are trying to accomplish.
    Run a Script (Program) When a Specific Program Opens/Closes in Windows | Windows OS Hub

    As another example of this, when auditing is enabled for process creation, entering the following filter will cause the task to be triggered each time when rundll32.exe creates an explorer.exe process:
    Code:
    <QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">*[System[band(Keywords,9007199254740992) and (EventID=4688)]] and *[EventData[Data[@Name='NewProcessName'] and (Data='C:\Windows\explorer.exe')]] and *[EventData[Data[@Name='ParentProcessName'] and (Data='C:\Windows\System32\rundll32.exe')]]</Select>
      </Query>
    </QueryList>
    To enable auditing for Detailed Tracking | Process Creation successes, run this in an elevated command prompt:
    Code:
    auditpol /set /subcategory:{0cce922b-69ae-11d9-bed3-505054503030} /success:enable
    To disable auditing for Detailed Tracking | Process Creation successes, run this in an elevated command prompt:
    Code:
    auditpol /set /subcategory:{0cce922b-69ae-11d9-bed3-505054503030} /success:disable
      My Computers


  5. Posts : 1
    Windows 10
       #5

    There is a much simpler way to send email at events than using PowerShell. Just use it: Mail Alert Simple Mailer download | SourceForge.net
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 14:51.
Find Us




Windows 10 Forums