Sharepoint audit - Opening or downloading documents events

Faye Müller 96 Reputation points
2021-03-17T08:22:48.817+00:00

Hi, I need some help to find, with powershell, all sites and sub-sites with native audit enable option "Opening or downloading documents, viewing items in lists, or viewing item properties" enabled. Thanks for help me Regards Faye

Microsoft 365 and Office | SharePoint Server | For business
{count} votes

1 answer

Sort by: Most helpful
  1. Echo Du_MSFT 17,316 Reputation points
    2021-03-18T05:50:19.047+00:00

    Hello anonymous user ,

    Enable all audit settings on all site collections using PowerShell.

    Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue  
    [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges(  
    {  
       $sites = Get-SPSite -Limit All  
       foreach($site in $sites)  
       {  
           $site.Audit.AuditFlags = $site.Audit.AuditFlags = [Microsoft.SharePoint.SPAuditMaskType]::CheckOut `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::CheckIn `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::View `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Delete `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Update `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::ProfileChange `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::ChildDelete `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::SchemaChange `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::SecurityChange `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Undelete `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Workflow `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Copy `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Move `  
    -bxor [Microsoft.SharePoint.SPAuditMaskType]::Search  
           $site.Audit.Update()  
           $site.Dispose()  
       }  
    })  
    

    78957-audit.png

    Thanks,
    Echo Du

    ====================

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.