SharePoint Audit Policy: Security Change

This audit flag corresponds to the "Editing users and permissions" check box on the "Site collection audit settings" page in Site Collection Administration.

These events document access control related changes to groups, permissions and site collection administrators.

Audit Flag

Event ID by LOGbinder for SharePoint

SecurityChange

11 - Site collection audit policy changed

12 - Audit policy changed

20 - Audit logs deleted

25 - SharePoint group created

26 - SharePoint group deleted

27 - SharePoint group member added

28 - SharePoint group member deleted

29 - Unique permissions created

30 - Unique permissions removed

31 - Permissions updated

32 - Permissions removed

33 - Unique permission levels created

34 - Permission level created

35 - Permission level deleted

36 - Permission level modified

37 - SharePoint site collection administrator added

38 - SharePoint site collection administrator removed

 

Upcoming Webinars
  • Understanding the Multiple Layers of Privileged Access in Windows
  • The Top 5 Challenges of Windows Event Collection – And How to Solve Them
Additional Resources
    Audit Policy
    •Check In/Out
    •Custom
    •View
    •Delete
    •Update
    •Security Change
    •Copy/Move
    •Search
    •Workflow
    •Profile/Schema Change
     
     
    User name:
    Password:
      / Forgot?
      Register
    June 2025
    Patch Tuesday
    "Patch Tuesday - Two Zero Days and 11 Critical Updates " - sponsored by LOGbinder and Supercharger
    Home
    Tweet
    Follow @randyfsmith
    About | Newsletter | Contact Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2025 Monterey Technology Group, Inc. All rights reserved.
    Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.
    Terms of Use | Privacy |
    Cookies help us deliver the best experience on our website. By using our website, you agree to the use of cookies.