How to Audit SharePoint Changes by viewing Audit Logs

Audit SharePoint Changes with Lepide Auditor
Or Deploy With Our Virtual Appliance
3 min read | Updated On - March 08, 2024
In This Article

With many organizations hosting their critical data on SharePoint sites, it is crucial that attention must be given to the security of the information contained in them. There is always a risk of users misusing or manipulating sensitive data assets (be it intentionally or accidentally). Identifying these changes promptly helps in instigating measures to protect them. This article sheds some light on the steps required to track changes in SharePoint both natively and using Lepide SharePoint Auditor. Let’s begin with the native method.

Audit Changes made to SharePoint with Native Auditing

Please follow below steps for native auditing:

Step 1: Enable Audit Log Feature in Central Administration Site

  • Go to “Application Management” section, click “Manage service applications” under “Service Applications” on the right-pane.
  • Select “Secure Store Service Application” from the list. On the ribbon, click “Properties”.
  • In the “Edit Secure Store Service Application” page,scroll down to enable the audit section.
  • In “Enable Audit section”, click to select “Audit log enabled” and set “Days Until Purge” as 30 (the default value is 30 days).
    Enable the audit section
    Figure 1: Enable the audit section
  • To save the changes, click “OK”.
  • Click “OK” on the confirmation message on the screen.
    Confirmation message
    Figure 2: Confirmation message

Step 2: Enable auditing at Site Collection level

Follow the steps given below to configure the audit settings:

  • Click Gear icon on the top right of the homepage and then click “Site Settings”.
  • Now under “Site Collection Administration”,click “Site collection audit settings”.
  • In “Configure Audit Settings” page, select the check boxes to specify the events that you want to be audited.
    Configure Audit Settings page
    Figure 3: Configure Audit Settings page
  • Click “OK” to save the changes.

Step 3: View Audit Log Reports

After the audit functionality is enabled, data will be automatically logged. You can filter and analyze the audit data for sites, lists, libraries, list items, content types, and much more. To view the audit reports:

  • Click “Audit log reports” link under “Site Collection Administration”.
  • In “View Auditing Reports” page, pick up the relevant report. You will see different reports.
  • After selecting the required report, browse the location where you would like to save the excel spreadsheet to view the report.
    Browse the location to save the report
    Figure 4: Browse the location to save the report

    The following is a report showing site content modifications in an excel sheet using native method.

    Site content modifications report
    Figure 5: Site content modifications report

Issues with Native Auditing of SharePoint Server

You can see that the site content modifications report shown above does not explicitly specify the exact changes made to the site contents. When using the inbuilt mechanisms to audit SharePoint, one has to devote a considerable amount of time to derive anything meaningful. You will have to enable audit logging, configure the audit settings and then extract details from the log reports. This process is quite time-consuming and is often a daunting task for admins.

How Lepide SharePoint Auditor Helps in Auditing Changes

Lepide SharePoint Auditor is a comprehensive auditing solution that tracks and monitors security, configuration and data level changes made to both SharePoint on-premise and online. Our cutting-edge auditing solution enables you to store data in a centralized and secure database.

The following is a screenshot of the “All SharePoint Modifications Reports” generated by Lepide SharePoint Auditor with granular details like who made what changes to which object and when.

All SharePoint Modifications Reports - screenshot
Figure 6: All SharePoint Modifications Report

With a fast and simple way to audit SharePoint, Administrators are no longer required to spend hours collecting and organizing data from unmanageable logs. The predefined audit reports by Lepide’s SharePoint auditing tool make it easy to determine who, where, what and when a change was made.

Try Lepide SharePoint Auditing solution for free
Or Deploy With Our Virtual Appliance
Learn More...

Audit SharePoint Changes with Lepide Auditor

Or Deploy With Our Virtual Appliance
Learn More...