SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello I'm a newbie SharePoint developer.

Someone delete a list permission groups and there is no backup. There is no documents about this permission settings. We are really under frustrated situation.

We want to find who delete this permission. There is a way to find this?

share|improve this question
If audit logs are enabled in your farm, you can run custom audit log report to get this. – Prashant Lakhlani Feb 25 '13 at 6:39
@PrashantLakhlani if audit logs are not enabled, there is no way to find this Q.Q? – Donam. J. K Feb 25 '13 at 11:01
up vote 2 down vote accepted

Like Prashant said, audit logs are the best way. If you know the deletion happened via the website, you could also sort through the iis logs and look for a POST (not a GET) to


That should at least narrow down a list of users who have made some type of change to the permissions on the site.

Another thought is to write a query to the ChangeLog This is assuming not so much time has pasted since the event so the event will be in the changelog. By default entries in the changelog expire after 60 days (

When auditing first came out in SP 2007, I wrote a feature that automatically turned on auditing for every existing site collection and when a new one is created. You might should look into something similar if you need to support these type of questions in the future.

share|improve this answer
Thank you Steve :) – Donam. J. K Feb 25 '13 at 21:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.