Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Hello I'm a newbie SharePoint developer.

Someone delete a list permission groups and there is no backup. There is no documents about this permission settings. We are really under frustrated situation.

We want to find who delete this permission. There is a way to find this?

share|improve this question
2  
If audit logs are enabled in your farm, you can run custom audit log report to get this. –  Prashant Lakhlani Feb 25 '13 at 6:39
    
@PrashantLakhlani if audit logs are not enabled, there is no way to find this Q.Q? –  Donam. J. K Feb 25 '13 at 11:01
add comment

1 Answer

up vote 2 down vote accepted

Like Prashant said, audit logs are the best way. If you know the deletion happened via the website, you could also sort through the iis logs and look for a POST (not a GET) to

<yoursiteurlhere>/_layouts/user.aspx

That should at least narrow down a list of users who have made some type of change to the permissions on the site.

Another thought is to write a query to the ChangeLog http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spchange.aspx. This is assuming not so much time has pasted since the event so the event will be in the changelog. By default entries in the changelog expire after 60 days (http://msdn.microsoft.com/en-us/library/bb417456(v=office.14).aspx).

When auditing first came out in SP 2007, I wrote a feature that automatically turned on auditing for every existing site collection and when a new one is created. You might should look into something similar if you need to support these type of questions in the future.

share|improve this answer
    
Thank you Steve :) –  Donam. J. K Feb 25 '13 at 21:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.