SharePoint Audit Log Event ID 22

SourceSharePoint (LOGbinder SP)
Audit FlagProfileChange
Windows Security Log
Category
 • Subcategory
Object Access
 • Application Generated
Type Success

22: Object profile changed

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  ProfileChange.

On this page

This event appears to be logged when the ContentTypes for a list or document library are changed.  Also see event ID 23.

Free Security Log Resources by Randy

Description Fields in 22

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Object
    • Type: Such as List
    • Subtype: such as Document Library
    • URL: URL of the object targeted by this operation
    • Title: title of the object targeted by this operation
    • Description:
  • Profile details: The XML representation of the object profile, usually ContenType definitions

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 22

Object profile changed
Occurred: 11/21/2011 3:15:29 PM
Site: http://sp2010-sp
User: System Account
Object
  Type: List
  Subtype: Generic List
  URL: /Lists/Tasks/AllItems.aspx
  Title: Tasks
  Description: Use the Tasks list to keep track of work that you or your team needs to complete.
Profile details: <ContentType ID="0x01080030F71437AD53BC458A9F8A6F248E9D21" Name="Task" Group="List Content Types" Description="Track a work item that you or your team needs to complete." Version="4" FeatureId="{695b6570-a48b-4a8e-8ea5-26ea7fc1d162}"><Folder TargetName="Task" /><Fields><Field ID="{c042a256-787d-4a6f-8a8a-cf6ab767f12d}" Type="Computed" DisplayName="Content Type" Name="ContentType" DisplaceOnUpgrade="TRUE" RenderXMLUsingPattern="TRUE" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="ContentType" Group="_Hidden" PITarget="MicrosoftWindowsSharePointServices" PIAttribute="ContentTypeID" FromBaseType="TRUE"><FieldRefs><FieldRef Name="ContentTypeId" /></FieldRefs><DisplayPattern><MapToContentType><Column Name="ContentTypeId" /></MapToContentType></DisplayPattern></Field><Field ID="{fa564e0f-0c70-4ab9-b863-0177e6ddd247}" Type="Text" Name="Title" DisplayName="Title" Required="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Title" FromBaseType="TRUE" ColName="nvarchar1" ShowInNewForm="TRUE" ShowInEditForm="TRUE" /><Field ID="{c3a92d97-2b77-4a25-9698-3ab54874bc6f}" Name="Predecessors" Type="LookupMulti" Mult="TRUE" Required="FALSE" DisplayName="Predecessors" StaticName="Predecessors" List="Self" ShowField="Title" DisplaceOnUpgrade="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" ColName="int1" /><Field ID="{a8eb573e-9e11-481a-a8c9-1104a54b2fbd}" Type="Choice" Name="Priority" DisplayName="Priority" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Priority" ColName="nvarchar3"><CHOICES><CHOICE>(1) High</CHOICE><CHOICE>(2) Normal</CHOICE><CHOICE>(3) Low</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">(1) High</MAPPING><MAPPING Value="2">(2) Normal</MAPPING><MAPPING Value="3">(3) Low</MAPPING></MAPPINGS><Default>(2) Normal</Default></Field><Field Type="Choice" ID="{c15b34c3-ce7d-490a-b133-3f4de8801b76}" Name="Status" DisplayName="Status" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Status" ColName="nvarchar4"><CHOICES><CHOICE>Not Started</CHOICE><CHOICE>In Progress</CHOICE><CHOICE>Completed</CHOICE><CHOICE>Deferred</CHOICE><CHOICE>Waiting on someone else</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">Not Started</MAPPING><MAPPING Value="2">In Progress</MAPPING><MAPPING Value="3">Completed</MAPPING><MAPPING Value="4">Deferred</MAPPING><MAPPING Value="5">Waiting on someone else</MAPPING></MAPPINGS><Default>Not Started</Default></Field><Field ID="{d2311440-1ed6-46ea-b46d-daa643dc3886}" Type="Number" Name="PercentComplete" Percentage="TRUE" Min="0" Max="1" DisplayName="% Complete" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="PercentComplete" ColName="float1" /><Field ID="{53101f38-dd2e-458c-b245-0c236cc13d1a}" Type="User" List="UserInfo" Name="AssignedTo" DisplayName="Assigned To" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="AssignedTo" ColName="int2" /><Field ID="{7662cd2c-f069-4dba-9e35-082cf976e170}" Type="Note" RichText="TRUE" Name="Body" DisplayName="Description" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Body" ColName="ntext2" /><Field ID="{64cd368d-2f95-4bfc-a1f9-8d4324ecb007}" Type="DateTime" Name="StartDate" DisplayName="Start Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="StartDate" ColName="datetime1"><Default>[today]</Default></Field><Field Type="DateTime" ID="{cd21b4c2-6841-4f9e-a23a-738a65f99889}" Name="DueDate" DisplayName="Due Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="DueDate" ColName="datetime2" /><Field ID="{b0227f1a-b179-4d45-855b-a18f03706bcb}" Name="_dlc_Exempt" StaticName="_dlc_Exempt" DisplayName="Exempt from Policy" SourceID="http://schemas.microsoft.com/sharepoint/v3" Group="Document and Record Management Columns" Type="ExemptField" Indexed="FALSE" Hidden="TRUE" CanToggleHidden="TRUE" ShowInNewForm="FALSE" ShowInEditForm="FALSE" ShowInFileDlg="FALSE" ShowInDisplayForm="FALSE" Required="FALSE" Sealed="TRUE" ReadOnly="TRUE" OverwriteInChildScopes="TRUE" ColName="bit1" RowOrdinal="0" /></Fields><XmlDocuments><XmlDocument NamespaceURI="office.server.policy"><p:Policy xmlns:p="office.server.policy" id="" local="true"><p:Name>Task</p:Name><p:Description></p:Description><p:Statement></p:Statement><p:PolicyItems><p:PolicyItem featureId="Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit" staticId="0x01080030F71437AD53BC458A9F8A6F248E9D21|8138272" UniqueId="1356e9d9-0659-4c11-bddf-0ed70a5e023e"><p:Name>Auditing</p:Name><p:Description>Audits user actions on documents and list items to the Audit Log.</p:Description><p:CustomData><Audit><Update /><View /><CheckInOut /><MoveCopy /><DeleteRestore /></Audit></p:CustomData></p:PolicyItem></p:PolicyItems></p:Policy></XmlDocument><XmlDocument NamespaceURI="microsoft.office.server.policy.changes"><PolicyDirtyBag xmlns="microsoft.office.server.policy.changes"><Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit op="Change" xmlns="" /></PolicyDirtyBag></XmlDocument><XmlDocument NamespaceURI="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><FormTemplates xmlns="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><Display>ListForm</Display><Edit>ListForm</Edit><New>ListForm</New></FormTemplates></XmlDocument></XmlDocuments></ContentType>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

 

Additional Resources

    Go To Event ID:

    Security Log
    Quick Reference
    Chart
    Download now!