Audiit loggs for the SharePoint site

Question

Some one changed the permissions and move to readers group for one of the users, we would like to know who did it. How to verify in the audit logs? Please suggest. It is SharePoint 2016 site

Answer 1

Hi @Diptesh Kumar ,

You need to configure SharePoint Auditing for SharePoint 2016 first, then view who changed permissions in the audit log report.

Here are steps:

1.Enable Audit Log Feature in Central Administration Site: Open Central Administration > Manage Service Applications > Select Secure Store Service Application > in the ribbon select properties > then scroll to the bottom of the window and tick audit log enabled. You can also create Secure Store Service Application in SharePoint Server using PowerShell. Please refer to: https://www.sharepointdiary.com/2016/08/powershell-to-create-secure-store-service-application-in-sharepoint.html

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

2.Enable SharePoint auditing on the Site Collections Level 

3.View Audit Log Reports for permissions: Site Settings>under “Site Collection Administration”, click “Site collection audit settings”.

You can refer to this link for detailed steps and screenshots: https://www.lepide.com/how-to/track-changes-in-sharepoint-server-2016.html

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.