SharePoint Audit Policy: Security Change

This audit flag corresponds to the "Editing users and permissions" check box on the "Site collection audit settings" page in Site Collection Administration.

These events document access control related changes to groups, permissions and site collection administrators.

Audit Flag

Event ID by LOGbinder for SharePoint

SecurityChange

11 - Site collection audit policy changed

12 - Audit policy changed

20 - Audit logs deleted

25 - SharePoint group created

26 - SharePoint group deleted

27 - SharePoint group member added

28 - SharePoint group member deleted

29 - Unique permissions created

30 - Unique permissions removed

31 - Permissions updated

32 - Permissions removed

33 - Unique permission levels created

34 - Permission level created

35 - Permission level deleted

36 - Permission level modified

37 - SharePoint site collection administrator added

38 - SharePoint site collection administrator removed

 

Upcoming Webinars
  • Breakdown of a Phishing Attack: Dissecting the Uber and MailChimp Data Breaches Before and After the Inbox
Additional Resources
    Audit Policy
    •Check In/Out
    •Custom
    •View
    •Delete
    •Update
    •Security Change
    •Copy/Move
    •Search
    •Workflow
    •Profile/Schema Change
     
     
    User name:
    Password:
      / Forgot?
      Register
    January 2023
    Patch Monday
    "Patch Tuesday - One Zero Day, Eleven Critical Updates "
    Home
    Tweet
    Follow @randyfsmith
    About | Newsletter | Contact Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2023 Monterey Technology Group, Inc. All rights reserved.
    Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.
    Terms of Use | Privacy | Return Policy