1

Is it possible to audit log only specific users (thus keeping the Audit-log under control and not harming performance)?

Background Sitecolletion admins can view and edit everything (de facto SP functionality). Even strictly confidential documents (on which unique and limited permissions are set). Management is not happy with that. They want to track/audit those highly confidential documents and especially the site collection admins*. (Those 'Top-secret' documents are scattered throughout the sitecollection)

What are my options?

*) ugh, distrusting your admins is not 'nice'.

Improve this question

1 Answer 1

Reset to default
2

If this is what you are facing then you should probably do a comprehensive security review and lock down the permissions on the site(s) in question, removing all but one or two trusted people from the role of Site Collection Administrator and then creating new permissions for other users, either as a different security group, a different permission level or (better option) both. This will get around the Site Collection Administrator 'full access' issue.

If you have your heart set on monitoring activity then you can get started simply enabling auditing in your Site Collection Settings. You can then slice the data as you need but there is no way to audit just certain users. Performance with auditing enabled is not a significant concern unless you have a site with hundreds of thousands of hits per day or a dramatically underpowered server.

Improve this answer
3
  • 1
    reading those logs are not at all fun. If it is a business critical requirement, I would look to 3rd party tools, that spit out nice formated reports you can use for audits, as well as "enforcing" rules for access. You may also want to lookat IRM for those confidential docs.
    – Jesus Shelby
    Jul 2, 2012 at 19:28
  • Site Collection admin is just two people, but management doesn't like the fact those two can read all (One of the SCAdmin is me ...). The site has thousands of hits a day (300 people working all day on 600 GB of documents) Thus my reluctance to activate Auditing.
    – Dribbel
    Jul 3, 2012 at 7:14
  • I have two sites that each have over a hundred thousand hits per day that both have auditing enabled on everything with no noticeable impact on performance. Go ahead and enable it. At the very worst, if you see performance issues you can always turn it back off.
    – Dave Wise
    Jul 3, 2012 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.