3

I am working on a team site collection where i have enabled the publishing features inside it. and i have enabled the reporting features inside it as follow (Site Collection Administration >> Site collection audit settings):-

enter image description here

Now i did this last week. today i access the "Content type and list modifications" report, where this report as its description should indicates

This report shows all events that modified content types and lists in this site.

now since i am the only site admin and the only user who have full control on the sites, and i did not make any changes to the lists and/or content types since last week.so i was expecting that the report will be empty.. but when i have generated the report i have noticed that there are many entries which have the following characteristics:-

All entries which i am referring to share the following values:-

Item Type = List

Event = Schema Change

then for the List i got these 4 values:-

Document Location = Access Requests OR Document Location = Relationships List OR Document Location = Variation Labels OR Document Location = Reports List

First Question. so i am not sure what are these 4 lists ? as i did not add these lists nor i can find them inside the site content.

Second Question. now for all the report entries the username is the system account.. which gives me an indication that these lists get modified as part of other actions within sharepoint itself. but which makes me worried is that there is a single entry which have its UserID not equal to the system account, and have the following details:-

Item Type = List

Event = Schema Change

Document Location = Reports List

and here is the event data:-

15.0.0.4911.0.0<FieldRef Name="ContentTypeId"/><Field ID="{fa564e0f-0c70-4ab9-b863-0177e6ddd247}" Type="Text" Name="Title" DisplayName="Report Title" Required="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Title" FromBaseType="TRUE" ColName="nvarchar1" Version="1" RowOrdinal="0"/><FieldRef Name="_ModerationComments" ColName="ntext1"/><Field ID="{bc91a437-52e7-49e1-8c4e-4698904b2b6d}" ReadOnly="TRUE" Type="Computed" Name="LinkTitleNoMenu" DisplayName="Report Title" Dir="" DisplayNameSrcField="Title" AuthoringInfo="$Resources:core,Linked_Item;" EnableLookup="TRUE" ListItemMenuAllowed="Prohibited" LinkToItemAllowed="Prohibited" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="LinkTitleNoMenu" FromBaseType="TRUE"><FieldRefs><FieldRef Name="Title"/><FieldRef Name="LinkFilenameNoMenu"/></FieldRefs><DisplayPattern><IfEqual><Expr1><LookupColumn Name="FSObjType"/></Expr1><Expr2>1</Expr2><Then><Field Name="LinkFilenameNoMenu"/></Then><Else><HTML><![CDATA[<a onfocus="OnLink(this)" href="]]></HTML><URL/><HTML><![CDATA[" onclick="EditLink2(this,]]></HTML><Counter Type="View"/><HTML><![CDATA[);return false;" target="_self">]]></HTML><Column HTMLEncode="TRUE" Name="Title" Default="$Resources:core,NoTitle;"/><IfEqual><Expr1><GetVar Name="ShowAccessibleIcon"/></Expr1><Expr2>1</Expr2><Then><HTML><![CDATA[<img src="/_layouts/15/images/blank.gif?rev=23" class="ms-hidden" border="0" width="1" height="1" alt="$Resources:core,OpenMenuKeyAccessible;"/>]]></HTML></Then></IfEqual><HTML><![CDATA[</a>]]></HTML><IfNew><HTML><![CDATA[<img src="/_layouts/[%=System.Threading.Thread.CurrentThread.CurrentUICulture.LCID%]/images/new.gif" alt="]]></HTML><HTML>$Resources:core,new_gif_alttext;</HTML><HTML><![CDATA[" class="ms-newgif" />]]></HTML></IfNew></Else></IfEqual></DisplayPattern></Field><Field ID="{82642ec8-ef9b-478f-acf9-31f7d45fbc31}" ReadOnly="TRUE" Type="Computed" Name="LinkTitle" DisplayName="Report Title" DisplayNameSrcField="Title" ClassInfo="Menu" AuthoringInfo="$Resources:core,Linked_Item_With_Menu;" ListItemMenuAllowed="Required" LinkToItemAllowed="Prohibited" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="LinkTitle" FromBaseType="TRUE"><FieldRefs><FieldRef Name="Title"/><FieldRef Name="LinkTitleNoMenu"/><FieldRef Name="_EditMenuTableStart2"/><FieldRef Name="_EditMenuTableEnd"/></FieldRefs><DisplayPattern><FieldSwitch><Expr><GetVar Name="FreeForm"/></Expr><Case Value="TRUE"><Field Name="LinkTitleNoMenu"/></Case><Default><HTML><![CDATA[<div class="ms-vb itx" onmouseover="OnItem(this)" CTXName="ctx]]></HTML><Field Name="_EditMenuTableStart2"/><HTML><![CDATA[">]]></HTML><Field Name="LinkTitleNoMenu"/><HTML><![CDATA[</div>]]></HTML><HTML><![CDATA[<div class="s4-ctx" onmouseover="OnChildItem(this.parentNode); return false;">]]></HTML><HTML><![CDATA[<span>&nbsp;</span>]]></HTML><HTML><![CDATA[<a onfocus="OnChildItem(this.parentNode.parentNode); return false;" onclick="PopMenuFromChevron(event); return false;" href="javascript:;" title="$Resources:core,open_menu;"></a>]]></HTML><HTML><![CDATA[<span>&nbsp;</span>]]></HTML><HTML><![CDATA[</div>]]></HTML></Default></FieldSwitch></DisplayPattern></Field><Field ID="{5f190d91-3dbc-4489-9878-3c092caf35b6}" Hidden="TRUE" ReadOnly="TRUE" Type="Computed" Name="LinkTitle2" DisplayName="Report Title" DisplayNameSrcField="Title" ClassInfo="Menu" AuthoringInfo="$Resources:core,Linked_Item_With_Menu; (old)" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="LinkTitle2" FromBaseType="TRUE"><FieldRefs><FieldRef Name="Title"/><FieldRef Name="LinkTitleNoMenu"/><FieldRef Name="_EditMenuTableStart"/><FieldRef Name="_EditMenuTableEnd"/></FieldRefs><DisplayPattern><FieldSwitch><Expr><GetVar Name="FreeForm"/></Expr><Case Value="TRUE"><Field Name="LinkTitleNoMenu"/></Case><Default><Field Name="_EditMenuTableStart"/><SetVar Name="ShowAccessibleIcon" Value="1"/><Field Name="LinkTitleNoMenu"/><SetVar Name="ShowAccessibleIcon" Value="0"/><Field Name="_EditMenuTableEnd"/></Default></FieldSwitch></DisplayPattern></Field><FieldRef Name="File_x0020_Type" ColName="nvarchar2"/><Field ID="{8c4cfe39-587c-45b0-9754-71810a01c5e2}" Type="Text" DisplayName="$Resources:cmscore,ReportsListTitleResourceId" Required="FALSE" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="_x0024_Resources_x003a_cmscore_x" Name="_x0024_Resources_x003a_cmscore_x" ColName="nvarchar3" RowOrdinal="0" Version="1"/><Field ID="{9a0a9832-8bf1-4de4-a809-c97bd256fbe7}" Type="Text" DisplayName="$Resources:cmscore,ReportsListTitleResourceId" Required="FALSE" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="_x0024_Resources_x003a_cmscore_x0" Name="_x0024_Resources_x003a_cmscore_x0" ColName="nvarchar4" RowOrdinal="0" Version="1"/><Field ID="{33254558-5f60-43a1-8c30-f02bee20d03a}" Type="Text" DisplayName="$Resources:cmscore,SmtListType" Required="FALSE" Description="$Resources:cmscore,SmtReportsListTypeDesc" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="_x0024_Resources_x003a_cmscore_x1" Name="_x0024_Resources_x003a_cmscore_x1" ColName="nvarchar5" RowOrdinal="0" Version="1"/><Field ID="{0500c41a-0f80-4b01-9892-7c085eb461ab}" Type="Text" DisplayName="$Resources:cmscore,SmtCamlQuery" Required="TRUE" Description="$Resources:cmscore,SmtReportsQueryDesc" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="_x0024_Resources_x003a_cmscore_x2" Name="_x0024_Resources_x003a_cmscore_x2" ColName="nvarchar6" RowOrdinal="0" Version="1"/><Field ID="{61cbb965-1e04-4273-b658-eedaa662f48d}" Type="TargetTo" Name="Target_x0020_Audiences" DisplayName="Target Audiences" Required="FALSE" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="Target_x0020_Audiences" ColName="ntext2" RowOrdinal="0" Version="2"><Customization><ArrayOfProperty><Property><Name>AllowGlobalAudience</Name><Value xmlns:q1="http://www.w3.org/2001/XMLSchema" p4:type="q1:boolean" xmlns:p4="http://www.w3.org/2001/XMLSchema-instance">true</Value></Property><Property><Name>AllowDL</Name><Value xmlns:q2="http://www.w3.org/2001/XMLSchema" p4:type="q2:boolean" xmlns:p4="http://www.w3.org/2001/XMLSchema-instance">true</Value></Property><Property><Name>AllowSPGroup</Name><Value xmlns:q3="http://www.w3.org/2001/XMLSchema" p4:type="q3:boolean" xmlns:p4="http://www.w3.org/2001/XMLSchema-instance">true</Value></Property></ArrayOfProperty></Customization></Field><Field ID="{9da97a8a-1da5-4a77-98d3-4bc10456e700}" Type="Text" Name="Report_x0020_Description" DisplayName="Report Description" Required="FALSE" SourceID="{128d73ab-33f7-4d9f-84e0-a8ad33898c57}" StaticName="Report_x0020_Description" ColName="nvarchar7" RowOrdinal="0" Version="1"/>

now this user who performed this event have Read permission on the site.. so not sure how he can modify the schema for the Reports list !!

so can anyone advice on my above 2 questions? and am i having problems?

0

You have selected "Opening or downloading documents, viewing items in lists, or viewing item properties" event too which logs READ activities too. So even if your users have read access, the viewing events will be logged.

Check all your sites under the site collection for the Lists. You have posted the log item without list title. Please Post the screenshot of the Actual Audit report.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.