SharePoint Audit Log Event ID 30

SourceSharePoint (LOGbinder SP)
Audit FlagSecurityChange
Windows Security Log
Category
 • Subcategory
Object Access
 • Application Generated
Type Success
Discussions on Event ID 30
Ask a question about this event

30: Unique permissions removed

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  SecurityChange.

On this page

Unique permissions have been removed and the child is now inheriting permissions from the parent.

Free Security Log Resources by Randy

Description Fields in 30

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Parent Object
    • Type: parent object type
    • Subtype: if defined
    • URL: URL of the parent object
    • Title: Parent object title
    • Description:
  • Object
    • URL: URL of the object targeted by this operation

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 30

Unique permissions removed
Occurred: 11/22/2011 12:54:47 AM
Site: http://sp2010-sp
User: System Account
Parent Object
  Type: Web
  Subtype: n/a
  URL: Lists/My List
  Title: n/a
  Description: n/a
Object
  URL: Lists/My List
This object, which formerly had unique permissions, now inherits permissions from the parent.

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources