SharePoint Audit Log Event ID 26

SourceSharePoint (LOGbinder SP)
Audit FlagSecurityChange
Windows Security Log
Category
 • Subcategory		Object Access
 • Application Generated
Type Success

26: SharePoint group deleted

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  SecurityChange.

On this page

Indicates a SharePoint group was deleted (see event ID 25).  For this event SharePoint does not supply the group name.  Refer to events 25, 27, 28, as these may contain the group name.

Free Security Log Resources by Randy

Description Fields in 26

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Group
    • ID: internal ID number of the group

Supercharger Enterprise


 

Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 26

SharePoint group deleted
Occurred: 11/22/2011 12:07:25 AM
Site: http://sp2010-sp
User: System Account
Group
  ID: 27
The group name is not available because Microsoft does not report this. Refer to events 25, 27, 28, as these may contain the group name.

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
    Additional Resources

      Go To Event ID:

      Security Log
      Quick Reference
      Chart
      Download now!