we have a powershell script to extract data from the audit log filtering by group membership update (audit Editing users and permissions enable at site level)
while we have a perfect match for the SecGroupMemberAdd it seems like we are missing some SecGroupMemberDel matching the group membership: we cannot see any deletion to a member that result added but is not present anymper in the groups. I should say that the content database was attached a couple of times from a dev farm (differente domain) to a cert farm e production farm (the last ones on the same domain) here an excerpt of the code used
$searchPattern = "*<user>$userId</user>*"
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel
$eventType2 = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd
$usersList = $site.RootWeb.SiteUserInfoList
$query = New-Object Microsoft.SharePoint.SPAuditQuery($site)
$query.AddEventRestriction($eventType2)
$query.AddEventRestriction($eventType)
$query.SetRangeStart($startDate)
does anyone have any hints on what it could be wrong?
thanks