SharePoint Audit Log Event ID 12
12: Audit policy changed
This is an event from
SharePoint
audit event from
LOGbinder SP
generated by
.
On this page
This event indicates audit policy has been set on a specific object. See event ID 11 for site collection audit policy change.
Free Security Log Resources by Randy
- Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
- Site: This is the URL of the site generating this event
- User: name of the user who performed the action
- Object
- Type: Document, Folder, Item, etc
- Subtype: usually n/a
- URL: URL of the object targeted by this operation
- Title: may be n/a
- Description: may be n/a
- New audit policy: Audit Flags
Setup PowerShell Audit Log Forwarding in 4 Minutes
This Event Is Produced By
Which Integrates with Your SIEM