How to read the SharePoint Security Audit Report

User request to check who's remove the permission !!!   As a SharePoint Admin we can get the information from the audit report ( anyway need to enable it before else will not have data available)

Site Settings > Audit log Reports : Select the Security settings

Once you get the report , we can get the information from the report .

Information below from the column good enough to find out who change the permission


User ID : Person done the change

Event Data : what permission is change (but is in number , so the number is represent the role showed as following )


Full Control 1073741829
Contribute 1073741827
Read 1073741826


This id is given by SharePoint , you can get it by do some programming or script.

1. Go to the sites with /_layouts/15/people.aspx?MembershipGroupId=0
2. You will see all the user over here, mouse over the id then you can see the left hand side bottom have the full URL detail showed . you can see the id here.

This information is showed what change is going on

About IM-8 Auditing ~ SSL RC4 Cipher Suites Supported

Recently we have some security audit is failed , so we need to fix something to pass the audit.  small part of the IM-8 we need to fix about the .

  SSL RC4 Cipher Suites Supported

 SSL Version 2 and 3 Protocol Detection

after ask around then found out need to change the server registry key to disable some other the RC4 , SSL V2 and V3 setting.

To make the task simple we have some simple tools for it :

first we need the scan tools , which is Nmap tools, you can download from internet.

after install and run following script :

nmap --script ssl-enum-ciphers 172.xx..yy.zz   -p 443

you will get the results look as following , as you see the SSlv3 is enable. 

Dowload NARTAC Software here : https://www.nartac.com/Products/IISCrypto/Download

After install then you can choice the setting you want , click Apply then Restart . Done.