How to find who delete list permissions?

Question

Hello I'm a newbie SharePoint developer.

Someone delete a list permission groups and there is no backup. There is no documents about this permission settings. We are really under frustrated situation.

We want to find who delete this permission. There is a way to find this?

Answer 1

Like Prashant said, audit logs are the best way. If you know the deletion happened via the website, you could also sort through the iis logs and look for a POST (not a GET) to

<yoursiteurlhere>/_layouts/user.aspx

That should at least narrow down a list of users who have made some type of change to the permissions on the site.

Another thought is to write a query to the ChangeLog http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spchange.aspx. This is assuming not so much time has pasted since the event so the event will be in the changelog. By default entries in the changelog expire after 60 days (http://msdn.microsoft.com/en-us/library/bb417456(v=office.14).aspx).

When auditing first came out in SP 2007, I wrote a feature that automatically turned on auditing for every existing site collection and when a new one is created. You might should look into something similar if you need to support these type of questions in the future.