SharePoint 2010 Audit log entries for Inherit and Break Inherit permissions not matching

Question

I have generated the Security settings Audit log report for one of my document libraries in Sharepoint 2010 site. This audit log has 6 entries for Event "Security Role Bind Break Inherit" and 1 entry for "Security Role Bind Inherit".

I was expecting these 2 events to be the same number since you cannot force inheritance without a corresponding break inheritance event. Auditing was never turned Off for the folder so it is not possible that some events were not included in the audit log.

Can someone please explain how these audit log entries for Inherit and Break Inherit are so far apart for the same Folder?

Answer 1

You could use the audit feature of SharePoint Server 2010 to track which users have taken what actions on the sites, content types, lists, libraries, list items, and library files of site collections. Please refer to the article.

Configure audit settings for a site collection

In site collection root, "Site Actions" >> "Site Settings" >> "Site Collection Administration" >> "Audit log reports" >> "Security settings" and see the permission audit log report.

Before viewing the audit log report, it's needed to specify the "Editing users and permissions" events to audit.

In site collection root site, "Site Settings" >> "Site Collection Administration" >> "Site collection audit settings", check the "Editing users and permissions" option.

After doing this process, the changes to permissions on sites, lists and items will be audited in audit log report.

This below link about to view audit log reports for your reference:

View audit log reports

For more information, please refer to the following articles

Assigning SharePoint List Item level permission programmatically

Break Inheritance Permissions in SharePoint 2010 Team Sites

Hope it help