4

Is it possible to find out in SharePoint 2010 who added a user to a particular group and when, or is this information not tracked at all?

6

Yes, it is possible in 2010 to find out who added a particular user to a group and when.

You do need to be collecting audit data.

You can query the audit data with Powershell, for example, to return the information you seek.

Here's a good sample script taken from this blog post:

$site = Get-SPSite "http://yoursite.company.com"

$startDate = Get-Date "1/1/2013 7:00 AM" 
$loginName = "domain\user" 
$userId = $site.RootWeb.AllUsers | ? { $_.UserLogin -eq $loginName } | % { $_.ID }

function DumpEvents($site, $searchPattern, $startDate, $eventType, $eventName) {  
  $usersList = $site.RootWeb.SiteUserInfoList  

  $query = New-Object Microsoft.SharePoint.SPAuditQuery($site) 
  $query.AddEventRestriction($eventType) 
  $query.SetRangeStart($startDate) 
  $result = $site.Audit.GetEntries($query) | ? { $_.EventData -like $searchPattern }     | % { 
   [xml]$eventData = "<eventData>" + $_.EventData + "</eventData>" 
   $groupId = $eventData.SelectSingleNode("//groupid").InnerText  
   $groupName = $groupId  
   try { $groupName = $usersList.GetItemById($groupId).Name } catch { } 
   $userName = $_.UserId 
   try { $userName  = $usersList.GetItemById($_.UserId)["Name"] } catch { } 
   Write-Host $eventName "Group" $groupName "on" $_.Occurred "by" $userName 
  } 
}

Write-Host Changes in group membership of $loginName since $startDate 
Write-Host ————————————————–

$searchPattern = "*<user>$userId</user>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel 
DumpEvents $site $searchPattern $startDate $eventType "Deleted from"

Write-Host ————————————————–

$searchPattern = "*<userId>$userId</userId>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd 
DumpEvents $site $searchPattern $startDate $eventType "Added to"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.