SharePoint Audit Log Event ID 27

SourceSharePoint (LOGbinder SP)
Audit FlagSecurityChange
Windows Security Log
 • Subcategory
Object Access
 • Application Generated
Type Success

27: SharePoint group member added

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  SecurityChange.

On this page

A member was added to a SharePoint group (see event ID 25 for more information on SharePoint groups).  This is an important event since members receive whatever permissions are assigned to the group.

Free Security Log Resources by Randy

Description Fields in 27

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Group
    • ID: the internal ID number of the SharePoint group
    • Name: display name of the group
  • Member
    • ID: internal ID number for the member
    • Name: logon name of the member user or name of the group if group nesting

Setup PowerShell Audit Log Forwarding in 4 Minutes


Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 27

SharePoint group member added
Occurred: 11/22/2011 10:46:34 PM
Site: http://sp2010-sp
User: Randy F. Smith
  ID: 22
  Name: Customer Information
  ID: 26
  Name: SP2010\wsmith

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources