we have a powershell script to extract data from the audit log filtering by group membership update (audit Editing users and permissions enable at site level)
while we have a perfect match for the SecGroupMemberAdd it seems like we are missing some SecGroupMemberDel matching the group membership: we cannot see any deletion to a member that result added but is not present anymper in the groups. I should say that the content database was attached a couple of times from a dev farm (differente domain) to a cert farm e production farm (the last ones on the same domain) here an excerpt of the code used
$searchPattern = "*<user>$userId</user>*" $eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel $eventType2 = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd $usersList = $site.RootWeb.SiteUserInfoList $query = New-Object Microsoft.SharePoint.SPAuditQuery($site) $query.AddEventRestriction($eventType2) $query.AddEventRestriction($eventType) $query.SetRangeStart($startDate)
does anyone have any hints on what it could be wrong?