I need some design ideas for a requirement to audit when uses are added/removed from an object. I need to collect the user doing the add/remove, date time, and reason for adding. I need to do this to sites, libraries lists and anything for that matter that has security permissions associated with it.
My thoughts were to add some type of event receiver that will fire when a user is added/removed. The question is what objects would I attached the event receiver to? Can you provide a general approach? Is it doable? Has it been done?
Thanks for reading!