question

faye avatar image
0 Votes"
faye asked EchoDu-MSFT commented

Sharepoint audit - Opening or downloading documents events

Hi, I need some help to find, with powershell, all sites and sub-sites with native audit enable option "Opening or downloading documents, viewing items in lists, or viewing item properties" enabled. Thanks for help me Regards Faye

office-sharepoint-server-administration
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @faye ,

Would you tell me whether your issue has been resolved or have any update?
I am looking forward to your reply.

Have a nice day!

0 Votes 0 ·

Hi @faye ,

Can you tell me whether your issue has been resolved or have any update?

I am looking forward to your reply.

0 Votes 0 ·

1 Answer

EchoDu-MSFT avatar image
0 Votes"
EchoDu-MSFT answered EchoDu-MSFT published

Hello @faye ,

Enable all audit settings on all site collections using PowerShell.

 Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
 [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges(
 {
    $sites = Get-SPSite -Limit All
    foreach($site in $sites)
    {
        $site.Audit.AuditFlags = $site.Audit.AuditFlags = [Microsoft.SharePoint.SPAuditMaskType]::CheckOut `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::CheckIn `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::View `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Delete `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Update `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::ProfileChange `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::ChildDelete `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::SchemaChange `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::SecurityChange `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Undelete `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Workflow `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Copy `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Move `
 -bxor [Microsoft.SharePoint.SPAuditMaskType]::Search
        $site.Audit.Update()
        $site.Dispose()
    }
 })

78957-audit.png

Thanks,
Echo Du
====================
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.




audit.png (18.8 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.