we have a powershell script to extract data from the audit log filtering by group membership update (audit Editing users and permissions enable at site level)

while we have a perfect match for the SecGroupMemberAdd it seems like we are missing some SecGroupMemberDel matching the group membership: we cannot see any deletion to a member that result added but is not present anymper in the groups. I should say that the content database was attached a couple of times from a dev farm (differente domain) to a cert farm e production farm (the last ones on the same domain) here an excerpt of the code used

$searchPattern = "*<user>$userId</user>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel
$eventType2 = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd 
$usersList = $site.RootWeb.SiteUserInfoList  

  $query = New-Object Microsoft.SharePoint.SPAuditQuery($site) 

does anyone have any hints on what it could be wrong?


1 Answer 1


I've finally found the culprit. I was looking for SelectSingleNode("//userid") node, while the missing Delete events only reports SelectSingleNode("//user") (always as id). Including also the user node catch all the events

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.