SharePoint Audit Log Event ID 38

SourceSharePoint (LOGbinder SP)
Audit FlagSecurityChange
Windows Security Log
 • Subcategory
Object Access
 • Application Generated
Type Success
Discussions on Event ID 38
Ask a question about this event

38: SharePoint site collection administrator removed

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  SecurityChange.

On this page

A member was removed from the site collection administrators.

Free Security Log Resources by Randy

Description Fields in 38

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Administrator
    • ID: ID of the site collection administrator that was removed
    • Name: Name of the site collection administrator that was removed 

Setup PowerShell Audit Log Forwarding in 4 Minutes


Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 38

SharePoint site collection administrator removed
Occurred: 2/12/2011 2:56:02 AM
Site: http://sp2010-sp
User: System Account
  ID: 20
  Name: NT AUTHORITY\system

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources