SharePoint Audit Log Event ID 22
22: Object profile changed
This is an event from
SharePoint
audit event from
LOGbinder SP
generated by
.
On this page
This event appears to be logged when the ContentTypes for a list or document library are changed. Also see event ID 23.
Free Security Log Resources by Randy
- Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
- Site: This is the URL of the site generating this event
- User: name of the user who performed the action
- Object
- Type: Such as List
- Subtype: such as Document Library
- URL: URL of the object targeted by this operation
- Title: title of the object targeted by this operation
- Description:
- Profile details: The XML representation of the object profile, usually ContenType definitions
Supercharger Free Edition
Supercharger's built-in Xpath filters leave the noise behind.
Free.
This Event Is Produced By

Which Integrates with Your SIEM
Object profile changed
Occurred: 11/21/2011 3:15:29 PM
Site: http://sp2010-sp
User: System Account
Object
Type: List
Subtype: Generic List
URL: /Lists/Tasks/AllItems.aspx
Title: Tasks
Description: Use the Tasks list to keep track of work that you or your team needs to complete.
Profile details: <ContentType ID="0x01080030F71437AD53BC458A9F8A6F248E9D21" Name="Task" Group="List Content Types" Description="Track a work item that you or your team needs to complete." Version="4" FeatureId="{695b6570-a48b-4a8e-8ea5-26ea7fc1d162}"><Folder TargetName="Task" /><Fields><Field ID="{c042a256-787d-4a6f-8a8a-cf6ab767f12d}" Type="Computed" DisplayName="Content Type" Name="ContentType" DisplaceOnUpgrade="TRUE" RenderXMLUsingPattern="TRUE" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="ContentType" Group="_Hidden" PITarget="MicrosoftWindowsSharePointServices" PIAttribute="ContentTypeID" FromBaseType="TRUE"><FieldRefs><FieldRef Name="ContentTypeId" /></FieldRefs><DisplayPattern><MapToContentType><Column Name="ContentTypeId" /></MapToContentType></DisplayPattern></Field><Field ID="{fa564e0f-0c70-4ab9-b863-0177e6ddd247}" Type="Text" Name="Title" DisplayName="Title" Required="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Title" FromBaseType="TRUE" ColName="nvarchar1" ShowInNewForm="TRUE" ShowInEditForm="TRUE" /><Field ID="{c3a92d97-2b77-4a25-9698-3ab54874bc6f}" Name="Predecessors" Type="LookupMulti" Mult="TRUE" Required="FALSE" DisplayName="Predecessors" StaticName="Predecessors" List="Self" ShowField="Title" DisplaceOnUpgrade="TRUE" SourceID="http://schemas.microsoft.com/sharepoint/v3" ColName="int1" /><Field ID="{a8eb573e-9e11-481a-a8c9-1104a54b2fbd}" Type="Choice" Name="Priority" DisplayName="Priority" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Priority" ColName="nvarchar3"><CHOICES><CHOICE>(1) High</CHOICE><CHOICE>(2) Normal</CHOICE><CHOICE>(3) Low</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">(1) High</MAPPING><MAPPING Value="2">(2) Normal</MAPPING><MAPPING Value="3">(3) Low</MAPPING></MAPPINGS><Default>(2) Normal</Default></Field><Field Type="Choice" ID="{c15b34c3-ce7d-490a-b133-3f4de8801b76}" Name="Status" DisplayName="Status" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Status" ColName="nvarchar4"><CHOICES><CHOICE>Not Started</CHOICE><CHOICE>In Progress</CHOICE><CHOICE>Completed</CHOICE><CHOICE>Deferred</CHOICE><CHOICE>Waiting on someone else</CHOICE></CHOICES><MAPPINGS><MAPPING Value="1">Not Started</MAPPING><MAPPING Value="2">In Progress</MAPPING><MAPPING Value="3">Completed</MAPPING><MAPPING Value="4">Deferred</MAPPING><MAPPING Value="5">Waiting on someone else</MAPPING></MAPPINGS><Default>Not Started</Default></Field><Field ID="{d2311440-1ed6-46ea-b46d-daa643dc3886}" Type="Number" Name="PercentComplete" Percentage="TRUE" Min="0" Max="1" DisplayName="% Complete" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="PercentComplete" ColName="float1" /><Field ID="{53101f38-dd2e-458c-b245-0c236cc13d1a}" Type="User" List="UserInfo" Name="AssignedTo" DisplayName="Assigned To" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="AssignedTo" ColName="int2" /><Field ID="{7662cd2c-f069-4dba-9e35-082cf976e170}" Type="Note" RichText="TRUE" Name="Body" DisplayName="Description" Sortable="FALSE" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="Body" ColName="ntext2" /><Field ID="{64cd368d-2f95-4bfc-a1f9-8d4324ecb007}" Type="DateTime" Name="StartDate" DisplayName="Start Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="StartDate" ColName="datetime1"><Default>[today]</Default></Field><Field Type="DateTime" ID="{cd21b4c2-6841-4f9e-a23a-738a65f99889}" Name="DueDate" DisplayName="Due Date" Format="DateOnly" SourceID="http://schemas.microsoft.com/sharepoint/v3" StaticName="DueDate" ColName="datetime2" /><Field ID="{b0227f1a-b179-4d45-855b-a18f03706bcb}" Name="_dlc_Exempt" StaticName="_dlc_Exempt" DisplayName="Exempt from Policy" SourceID="http://schemas.microsoft.com/sharepoint/v3" Group="Document and Record Management Columns" Type="ExemptField" Indexed="FALSE" Hidden="TRUE" CanToggleHidden="TRUE" ShowInNewForm="FALSE" ShowInEditForm="FALSE" ShowInFileDlg="FALSE" ShowInDisplayForm="FALSE" Required="FALSE" Sealed="TRUE" ReadOnly="TRUE" OverwriteInChildScopes="TRUE" ColName="bit1" RowOrdinal="0" /></Fields><XmlDocuments><XmlDocument NamespaceURI="office.server.policy"><p:Policy xmlns:p="office.server.policy" id="" local="true"><p:Name>Task</p:Name><p:Description></p:Description><p:Statement></p:Statement><p:PolicyItems><p:PolicyItem featureId="Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit" staticId="0x01080030F71437AD53BC458A9F8A6F248E9D21|8138272" UniqueId="1356e9d9-0659-4c11-bddf-0ed70a5e023e"><p:Name>Auditing</p:Name><p:Description>Audits user actions on documents and list items to the Audit Log.</p:Description><p:CustomData><Audit><Update /><View /><CheckInOut /><MoveCopy /><DeleteRestore /></Audit></p:CustomData></p:PolicyItem></p:PolicyItems></p:Policy></XmlDocument><XmlDocument NamespaceURI="microsoft.office.server.policy.changes"><PolicyDirtyBag xmlns="microsoft.office.server.policy.changes"><Microsoft.Office.RecordsManagement.PolicyFeatures.PolicyAudit op="Change" xmlns="" /></PolicyDirtyBag></XmlDocument><XmlDocument NamespaceURI="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><FormTemplates xmlns="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"><Display>ListForm</Display><Edit>ListForm</Edit><New>ListForm</New></FormTemplates></XmlDocument></XmlDocuments></ContentType>
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection