SharePoint Audit Log Event ID 22
22: Object profile changed
This is an event from
SharePoint
audit event from
LOGbinder SP
generated by
.
On this page
This event appears to be logged when the ContentTypes for a list or document library are changed. Also see event ID 23.
Free Security Log Resources by Randy
- Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
- Site: This is the URL of the site generating this event
- User: name of the user who performed the action
- Object
- Type: Such as List
- Subtype: such as Document Library
- URL: URL of the object targeted by this operation
- Title: title of the object targeted by this operation
- Description:
- Profile details: The XML representation of the object profile, usually ContenType definitions
Supercharger Enterprise
Load Balancing for Windows Event Collection
This Event Is Produced By
Which Integrates with Your SIEM
Object profile changed
Occurred: 11/21/2011 3:15:29 PM
Site: http://sp2010-sp
User: System Account
Object
Type: List
Subtype: Generic List
URL: /Lists/Tasks/AllItems.aspx
Title: Tasks
Description: Use the Tasks list to keep track of work that you or your team needs to complete.
Profile details: <ContentType ID="0x01080030F71437AD53BC458A9F8A6F248E9D21" Name="Task" Group="List Content Types" Description="Track a work item that you or your team needs to complete." Version="4" FeatureId="{695b6570-a48b-4a8e-8ea5-26ea7fc1d162}"><Folder TargetName="Task" /><Fields><Field ID="{c042a256-787d-4a6f-8a8a-cf6ab767f12d}" Type="Computed" DisplayName="Content Type" Name="ContentType" DisplaceOnUpgrade="TRUE" RenderXMLUsingPattern="TRUE" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="ContentType" Group="_Hidden" PITarget="MicrosoftWindowsSharePointServices" PIAttribute="ContentTypeID" FromBaseType="TRUE"><FieldRefs><FieldRef Name="ContentTypeId" /></FieldRefs><DisplayPattern><MapToContentType><Column Name="ContentTypeId" /></MapToContentType></DisplayPattern></Field><Field ID="{fa564e0f-0c70-4ab9-b863-0177e6ddd247}" Type="Text" Name="Title" DisplayName="Title" Required="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Title" FromBaseType="TRUE" ColName="nvarchar1" ShowInNewForm="TRUE" ShowInEditForm="TRUE" /><Field ID="{c3a92d97-2b77-4a25-9698-3ab54874bc6f}" Name="Predecessors" Type="LookupMulti" Mult="TRUE" Required="FALSE" DisplayName="Predecessors" StaticName="Predecessors" List="Self" ShowField="Title" DisplaceOnUpgrade="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" ColName="int1" /><Field ID="{a8eb573e-9e11-481a-a8c9-1104a54b2fbd}" Type="Choice" Name="Priority" DisplayName="Priority" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Priority" ColName="nvarchar3"><CHOICES><CHOICE>(1) High</CHOICE><CHOICE>(2) Normal</CHOICE><CHOICE>(3) Low</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">(1) High</MAPPING><MAPPING Value="2">(2) Normal</MAPPING><MAPPING Value="3">(3) Low</MAPPING></MAPPINGS><Default>(2) Normal</Default></Field><Field Type="Choice" ID="{c15b34c3-ce7d-490a-b133-3f4de8801b76}" Name="Status" DisplayName="Status" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Status" ColName="nvarchar4"><CHOICES><CHOICE>Not Started</CHOICE><CHOICE>In Progress</CHOICE><CHOICE>Completed</CHOICE><CHOICE>Deferred</CHOICE><CHOICE>Waiting on someone else</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">Not Started</MAPPING><MAPPING Value="2">In Progress</MAPPING><MAPPING Value="3">Completed</MAPPING><MAPPING Value="4">Deferred</MAPPING><MAPPING Value="5">Waiting on someone else</MAPPING></MAPPINGS><Default>Not Started</Default></Field><Field ID="{d2311440-1ed6-46ea-b46d-daa643dc3886}" Type="Number" Name="PercentComplete" Percentage="TRUE" Min="0" Max="1" DisplayName="% Complete" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="PercentComplete" ColName="float1" /><Field ID="{53101f38-dd2e-458c-b245-0c236cc13d1a}" Type="User" List="UserInfo" Name="AssignedTo" DisplayName="Assigned To" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="AssignedTo" ColName="int2" /><Field ID="{7662cd2c-f069-4dba-9e35-082cf976e170}" Type="Note" RichText="TRUE" Name="Body" DisplayName="Description" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Body" ColName="ntext2" /><Field ID="{64cd368d-2f95-4bfc-a1f9-8d4324ecb007}" Type="DateTime" Name="StartDate" DisplayName="Start Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="StartDate" ColName="datetime1"><Default>[today]</Default></Field><Field Type="DateTime" ID="{cd21b4c2-6841-4f9e-a23a-738a65f99889}" Name="DueDate" DisplayName="Due Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="DueDate" ColName="datetime2" /><Field ID="{b0227f1a-b179-4d45-855b-a18f03706bcb}" Name="_dlc_Exempt" StaticName="_dlc_Exempt" DisplayName="Exempt from Policy" SourceID="http://schemas.microsoft.com/sharepoint/v3" Group="Document and Record Management Columns" Type="ExemptField" Indexed="FALSE" Hidden="TRUE" CanToggleHidden="TRUE" ShowInNewForm="FALSE" ShowInEditForm="FALSE" ShowInFileDlg="FALSE" ShowInDisplayForm="FALSE" Required="FALSE" Sealed="TRUE" ReadOnly="TRUE" OverwriteInChildScopes="TRUE" ColName="bit1" RowOrdinal="0" /></Fields><XmlDocuments><XmlDocument NamespaceURI="office.server.policy"><p:Policy xmlns:p="office.server.policy" id="" local="true"><p:Name>Task</p:Name><p:Description></p:Description><p:Statement></p:Statement><p:PolicyItems><p:PolicyItem featureId="Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit" staticId="0x01080030F71437AD53BC458A9F8A6F248E9D21|8138272" UniqueId="1356e9d9-0659-4c11-bddf-0ed70a5e023e"><p:Name>Auditing</p:Name><p:Description>Audits user actions on documents and list items to the Audit Log.</p:Description><p:CustomData><Audit><Update /><View /><CheckInOut /><MoveCopy /><DeleteRestore /></Audit></p:CustomData></p:PolicyItem></p:PolicyItems></p:Policy></XmlDocument><XmlDocument NamespaceURI="microsoft.office.server.policy.changes"><PolicyDirtyBag xmlns="microsoft.office.server.policy.changes"><Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit op="Change" xmlns="" /></PolicyDirtyBag></XmlDocument><XmlDocument NamespaceURI="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><FormTemplates xmlns="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><Display>ListForm</Display><Edit>ListForm</Edit><New>ListForm</New></FormTemplates></XmlDocument></XmlDocuments></ContentType>
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection