Scope
This documentation is to find or trace user activities on
SharePoint website
Purpose
When we enable Audit Logs in SharePoint, we can track all the
events related to additions and deletions of users/groups in SharePoint.
We can trace the same events using SQL queries queried on site
content database as a SharePoint Administrator in more detailed manner.
Steps for Auditing
Below are the queries which have been used to trace the user
deletions:
1. Get the group ID and Site ID from
below query
SELECT * from Groups with (nolock)
where Title=’GroupName’;
2. Get all deleted instances of that
particular site scope from the below query…
SELECT * from
AuditData with (nolock) where EventData like
'<roleid>-1</roleid><principalid>’Principal ID’</principalid>%'
and ItemType=6 and Event=’Event Id’;
3. Get the User details with the ID
‘Owner ID’ using the below query...
SELECT * from
UserInfo with (nolock) where tp_ID=’Owner ID’;
4. Get the permissions which are deleted
in the above Site Scope by USER from below Query…
SELECT * from
dbo.Perms with (nolock) where ScopeId=’Scope ID';
