SharePoint Audit Policy: Copy/Move

These audit flags correspond to the "Moving or copying items to another location in the site" check box on the "Site collection audit settings" page in Site Collection Administration.

These flags track the copying or movement of SharePoint objects within SharePoint under some situations, but not all: Examples:

  • Using the Send To option in a library to copy a document to a different library - In our experience this generated an "Object copied" event.
  • Dragging a document between two libraries open in Explorer view (resulting in a move) - In our testing this generated a "Child object moved" event.
  • Ctrl-Dragging (Control key pressed while dragging) a document between two libraries open in Explorer view (resulting in a copy) - In our testing this generated none of the events listed here but did generate View events on the document in its source location and update events on the target copy.
  • Copying or moving objects via Site Administration \ Content and Structure - No copy or move events were generated but this did generate View events on the document in its source location and update events on the target copy. Also, the actions are recorded in the Content and Structure Logs under Site Administration; this log is not part of SharePoint auditing and not processed by LOGbinder for SharePoint.

Audit Flag

Event ID by LOGbinder for SharePoint

Move

16 - Child object moved

Copy

17 - Object copied

Move

21 - Object moved

 

Additional Resources