SharePoint Audit Log Event ID 54

54: Site collection information management policy created

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  Unknown or not applicable.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

The site collection informataion management policy configuration is found on the Site Collection Administration>Policies page in SharePoint. Event ID 43 (document updated) can be correlated to this event with the Policy ID.

The collection set (information management policy) that governs content was created. Expiration, auditing, document labels, and bar codes are examples of content management. This event is always audited and not connected with any audit flag.

The data shows the details of the policy after it was created.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 54

• Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
• Site: This is the URL of the site generating this event
• User: name of the user who performed the action
• Policy details: data connected with the policy after it was created.

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy