SharePoint 2007 site collection auditing

We start the year with another in our series of SharePoint hints and tips from our expert Darren Pritchard. This time he’s looking at how to sucessfully audit SharePoint site collections.

To enable/disable SharePoint auditing:

1. Open the site that you wish to audit
2. Click ‘Site Actions’
3. Select ‘Site Settings’
4. Click ‘Modify All Site Settings’
5. Under ‘Site Collection Administration’ you have ‘Site collection audit settings’
6. You would see Figure 1.
7. Here you can select what you wish to audit
8. Be very careful, SharePoint will not automatically purge these audit logs. They will continue to grow as long as they are enabled. I have seen content databases with 80GB of audit files!

Figure 1: Configure Audit settings page

To trim audit files:

1. Create the batch file shown in Figure 2. Note: CONTENTDATABASE is the name of the database within SQL.
2. Save it as ‘Purge Audit Logs.bat’
3. This will need to be run on your SharePoint Web frontend server as an Administrator. Do not be alarmed if it takes a little while to run. The time it takes depends on the amount of audit logs you are trying to trim.

SET STSADM="c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\bin\STSADM.EXE"

%stsadm% -o trimauditlog -date -databasename

Pause

Figure 2: Purge Audit Logs.bat

I would suggest running this on a system without users because it may have an impact on performance.

If you have large amounts of audit log files, I would recommend running the trim command on a month’s worth of audit logs at a time. The SQL transaction log file will grow very large during the trim process.

Once you have trimmed the audit logs you will need to run a shrink database task within SQL to reclaim the space used during the trim process.

I'd like to thank Darren for his continuing contributions, and a happy New Year to everyone.

Create custom permissions – for SharePoint

It’s been a while since we’ve published one of iTech-Ed Associate Darren Pritchard’s SharePoint 2007 beginners’ guides. This time he’s explaining custom permissions and how to create them.

Let’s start off by defining what we’re talking about. Specifying custom permission levels give you more control over the degree of access users can have to SharePoint sites, site collections, or site content. In effect, you create a new security group.

So, let’s run through the steps:

1. From the site collection click ‘Site Actions’ 
2. Click ‘Site Settings’
3. Under ‘Users and Permissions’ click ‘Advanced Permissions’ 
4. You will then see a list for permission level group
5. Select the ‘Settings’ drop down
6. Click ‘Permission Levels’
7. Click ‘Add a Permission Level’
8. You will then be able to create your own security group.

It’s worth remembering that only this site and all its sub-sites will have access to your new group.

Below is a list of permissions that can be set. Please note that selecting one may also result in others being selected because they are required as part of your selection.

List Permissions:

• Manage Lists – create and delete lists, add or remove columns in a list, and add or remove public views of a list.
• Override Check Out – discard or check in a document that is checked out to another user.
• Add Items – add items to lists, add documents to document libraries, and add Web discussion comments.
• Edit Items – edit items in lists, edit documents in document libraries, edit Web discussion comments in documents, and customize Web Part Pages in document libraries.
• Delete Items – delete items from a list, documents from a document library, and Web discussion comments in documents.
• View Items – view items in lists, documents in document libraries, and view Web discussion comments.
• Approve Items – approve a minor version of a list item or document.
• Open Items – view the source of documents with server-side file handlers.
• View Versions – view past versions of a list item or document.
• Delete Versions – delete past versions of a list item or document.
• Create Alerts – create e-mail alerts.
• View Application Pages – view forms, views, and application pages. Enumerate lists.

Site Permissions:

• Manage Permissions – create and change permission levels on the Web site and assign permissions to users and groups.
• View Usage Data – view reports on Web site usage.
• Create Subsites – create subsites such as team sites, Meeting Workspace sites, and Document Workspace sites.
• Manage Web Site – grants the ability to perform all administration tasks for the Web site as well as manage content.
• Add and Customize Pages – add, change, or delete HTML pages or Web Part Pages, and edit the Web site using a Windows SharePoint Services-compatible editor.
• Apply Themes and Borders – apply a theme or borders to the entire Web site.
• Apply Style Sheets – apply a style sheet (.css file) to the Web site.
• Create Groups – create a group of users that can be used anywhere within the site collection.
• Browse Directories – enumerate files and folders in a Web site using SharePoint Designer and Web DAV (Distributed Authoring and Versioning) interfaces.
• View Pages – view pages in a Web site.
• Enumerate Permissions – enumerate permissions on the Web site, list, folder, document, or list item.
• Browse User Information – view information about users of the Web site.
• Manage Alerts – manage alerts for all users of the Web site.
• Use Remote Interfaces – use SOAP, (Simple Object Access Protocol) Web DAV, or SharePoint Designer interfaces to access the Web site.
• Use Client Integration Features – use features that launch client applications. Without this permission, users will have to work on documents locally and upload their changes.
• Open – allows users to open a Web site, list, or folder in order to access items inside that container.
• Edit Personal User Information – allows a user to change his or her own user information, such as adding a picture.

Personal Permissions:

• Manage Personal Views – create, change, and delete personal views of lists.
• Add/Remove Personal Web Parts – add or remove personal Web Parts on a Web Part Page.
• Update Personal Web Parts – update Web Parts to display personalized information.

Armed with that information, you’re now in a position to try to create a new security group and give a person or a group of people a different level of access from what they had previously.