Report on who added user to SharePoint group and when?

Question

Is it possible to find out in SharePoint 2010 who added a user to a particular group and when, or is this information not tracked at all?

Answer 1

Yes, it is possible in 2010 to find out who added a particular user to a group and when.

You do need to be collecting audit data.

You can query the audit data with Powershell, for example, to return the information you seek.

Here's a good sample script taken from this blog post:

$site = Get-SPSite "http://yoursite.company.com"

$startDate = Get-Date "1/1/2013 7:00 AM" 
$loginName = "domain\user" 
$userId = $site.RootWeb.AllUsers | ? { $_.UserLogin -eq $loginName } | % { $_.ID }

function DumpEvents($site, $searchPattern, $startDate, $eventType, $eventName) {  
  $usersList = $site.RootWeb.SiteUserInfoList  

  $query = New-Object Microsoft.SharePoint.SPAuditQuery($site) 
  $query.AddEventRestriction($eventType) 
  $query.SetRangeStart($startDate) 
  $result = $site.Audit.GetEntries($query) | ? { $_.EventData -like $searchPattern }     | % { 
   [xml]$eventData = "<eventData>" + $_.EventData + "</eventData>" 
   $groupId = $eventData.SelectSingleNode("//groupid").InnerText  
   $groupName = $groupId  
   try { $groupName = $usersList.GetItemById($groupId).Name } catch { } 
   $userName = $_.UserId 
   try { $userName  = $usersList.GetItemById($_.UserId)["Name"] } catch { } 
   Write-Host $eventName "Group" $groupName "on" $_.Occurred "by" $userName 
  } 
}

Write-Host Changes in group membership of $loginName since $startDate 
Write-Host ————————————————–

$searchPattern = "*<user>$userId</user>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel 
DumpEvents $site $searchPattern $startDate $eventType "Deleted from"

Write-Host ————————————————–

$searchPattern = "*<userId>$userId</userId>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd 
DumpEvents $site $searchPattern $startDate $eventType "Added to"