SharePoint Audit Log Event ID 28
28: SharePoint group member removed
This is an event from
SharePoint
audit event from
LOGbinder SP
generated by
.
On this page
A member was removed from a SharePoint group (see event ID 25 for more information on SharePoint groups). This is an important event since members receive whatever permissions are assigned to the group. If a group is deleted at the same, time the group name may not be available. However the Group ID can be used to correlate to event ID 26 (SharePoint group deleted).
Free Security Log Resources by Randy
- Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
- Site: This is the URL of the site generating this event
- User: name of the user who performed the action
- Group
- ID: The group identifier internal to SharePoint
- Name: The group name in SharePoint (will not be available if the group is deleted)
- Member
- ID: The member identifier internal to SharePoint
- Name: Name of the member in SharePoint
Supercharger Free Edition
Supercharger's built-in Xpath filters leave the noise behind.
Free.
This Event Is Produced By
Which Integrates with Your SIEM