Home
%3CLINGO-SUB%20id%3D%22lingo-sub-571563%22%20slang%3D%22en-US%22%3EAuditing%20and%20the%20WorkFlow%20history%20list%20in%20MOSS%202007%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-571563%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Jan%2014%2C%202015%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CP%3EHello%20All%2C%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ERecently%20I%20was%20working%20with%20a%20customer%20who%20has%20MOSS%202007%20and%20as%20we%20are%20making%20improvements%20to%20this%20environment%20I%20realized%20that%20they%20had%20disabled%20the%20WorkFlow%20Cleanup%20Timer%20Job%20I%20then%20discovered%20that%20they%20had%20done%20this%20becuase%20somebody%20had%20told%20them%20to%20do%20this%20so%20that%20Site%20Collection%20owners%20could%20have%20audit%20logs%20using%20those%20lists...sigh%20%3CBR%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EThis%20SHOULD%20NOT%20BE%20DONE%2C%20the%20lists%20are%20not%20secured%20properly%20to%20be%20used%20as%20Audit%20logs%2C%20SharePoint%20does%26nbsp%3Baudit%20functionality%20built%20in%20and%20that%20is%20what%20you%20should%20use.%26nbsp%3B%20Here%20is%20the%20meat%20of%20the%20e-mail%20I%20sent%20to%20my%20customer%20to%20help%20them%20decide%20how%20to%20proceed.%20%3CBR%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EI%20highly%20recommend%20that%20you%20look%20at%20this%20project%20as%20a%20solution%20%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%3C%2FA%3E%20%3CBR%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%20%3CBR%20%2F%3E%3CP%3EFirst%20as%20I%20have%20mentioned%20in%20the%20past%20Workflow%20history%20lists%20were%20never%20intended%20to%20be%20used%20for%20auditing%2C%20and%20do%20not%20meet%20security%20requirements%20as%20regular%20users%20could%20gain%20access%20and%20edit%20entries.%26nbsp%3B%20Along%20the%20same%20lines%20writing%20to%20a%20list%20would%20be%20unacceptable%20for%20the%20same%20reason.%26nbsp%3B%20Please%20see%20this%20article%20for%20a%20note%20about%20Workflow%20History%20lists%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fee662522(v%3Doffice.14).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fee662522(v%3Doffice.14).aspx%20%3C%2FA%3E%20.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EThis%20leaves%20us%20with%20two%20choices%20the%20OOB%20audit%20functionality%20that%20is%20built%20into%20SharePoint%20or%20a%203%20%3CSUP%3E%20rd%20%3C%2FSUP%3E%20party%20tool%2C%20since%20this%20seems%20to%20be%20the%20only%20site%20that%20requires%20auditing%20(Please%20correct%20me%20if%20I%E2%80%99m%20wrong)%20I%20would%20recommend%20the%20OOB%20functionality%20as%20being%20the%20more%20cost%20effective%20choice.%26nbsp%3B%20Here%20is%20some%20relevant%20information%20about%20the%20audit%20functionality.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3COL%3E%3CBR%20%2F%3E%3CLI%3E%3CBR%20%2F%3E%3CP%3EAuditing%20and%20reporting%20is%20done%20at%20the%20Site%20Collection%20level%3C%2FP%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3E%3CBR%20%2F%3E%3CP%3EOOB%20there%20is%20limited%20setting%20that%20can%20be%20modified%20for%20Auditing%2C%20but%20it%20is%20customizable%3C%2FP%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3E%3CBR%20%2F%3E%3CP%3EThere%20is%20an%20auditflag%20for%20WorkFlows%20which%20means%20we%20could%20gather%20information%20and%20then%20create%20a%20custom%20report%20to%20view%20that%20data.%26nbsp%3B%20We%20could%20implement%20this%20following%20advice%20in%20this%20article%20%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%20%3C%2FA%3E%20NOTE%3A%20The%20exe%20in%20this%20article%20is%20not%20supported%20by%20Microsoft.%3C%2FP%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FOL%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EConfigure%20audit%20settings%20for%20a%20site%20collection%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-US%2FArticle%2FConfigure-audit-settings-for-a-site-collection-c4ee05e1-2ebd-45f1-a254-d2350aa44ae0%3Fui%3Den-US%26amp%3Brs%3Den-US%26amp%3Bad%3DUS%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20https%3A%2F%2Fsupport.office.com%2Fen-US%2FArticle%2FConfigure-audit-settings-for-a-site-collection-c4ee05e1-2ebd-45f1-a254-d2350aa44ae0%3Fui%3Den-US%26amp%3Brs%3Den-US%26amp%3Bad%3DUS%20%3C%2FA%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEvents%20audited%20when%20audit%20logging%20is%20enabled%20(Office%20SharePoint%20Server)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc824909(v%3Doffice.12).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc824909(v%3Doffice.12).aspx%20%3C%2FA%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ECustom%20Auditing%20In%20SharePoint%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Fmagazine%2Fcc794261.aspx%20%3C%2FA%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EItem-Level%20Auditing%20with%20SharePoint%20Server%202007%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Foffice%2Fbb397403(v%3Doffice.12).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Foffice%2Fbb397403(v%3Doffice.12).aspx%20%3C%2FA%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-571563%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20Jan%2014%2C%202015%20Hello%20All%2CRecently%20I%20was%20working%20with%20a%20customer%20who%20has%20MOSS%202007%20and%20as%20we%20are%20making%20improvements%20to%20this%20environment%20I%20realized%20that%20they%20had%20disabled%20the%20WorkFlow%20Cleanup%20Timer%20Job%20I%20then%20discovered%20that%20they%20had%20done%20this%20becuase%20somebody%20had%20told%20them%20to%20do%20this%20so%20that%20Site%20Collection%20owners%20could%20have%20audit%20logs%20using%20those%20lists.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-571563%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAudit%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Emoss%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
First published on TECHNET on Jan 14, 2015

Hello All,


Recently I was working with a customer who has MOSS 2007 and as we are making improvements to this environment I realized that they had disabled the WorkFlow Cleanup Timer Job I then discovered that they had done this becuase somebody had told them to do this so that Site Collection owners could have audit logs using those lists...sigh


This SHOULD NOT BE DONE, the lists are not secured properly to be used as Audit logs, SharePoint does audit functionality built in and that is what you should use.  Here is the meat of the e-mail I sent to my customer to help them decide how to proceed.


I highly recommend that you look at this project as a solution http://msdn.microsoft.com/en-us/magazine/cc794261.aspx




First as I have mentioned in the past Workflow history lists were never intended to be used for auditing, and do not meet security requirements as regular users could gain access and edit entries.  Along the same lines writing to a list would be unacceptable for the same reason.  Please see this article for a note about Workflow History lists http://technet.microsoft.com/en-us/library/ee662522(v=office.14).aspx .


This leaves us with two choices the OOB audit functionality that is built into SharePoint or a 3 rd party tool, since this seems to be the only site that requires auditing (Please correct me if I’m wrong) I would recommend the OOB functionality as being the more cost effective choice.  Here is some relevant information about the audit functionality.





  1. Auditing and reporting is done at the Site Collection level




  2. OOB there is limited setting that can be modified for Auditing, but it is customizable




  3. There is an auditflag for WorkFlows which means we could gather information and then create a custom report to view that data.  We could implement this following advice in this article http://msdn.microsoft.com/en-us/magazine/cc794261.aspx NOTE: The exe in this article is not supported by Microsoft.





Configure audit settings for a site collection


https://support.office.com/en-US/Article/Configure-audit-settings-for-a-site-collection-c4ee05e...



Events audited when audit logging is enabled (Office SharePoint Server)


http://technet.microsoft.com/en-us/library/cc824909(v=office.12).aspx



Custom Auditing In SharePoint


http://msdn.microsoft.com/en-us/magazine/cc794261.aspx



Item-Level Auditing with SharePoint Server 2007


http://msdn.microsoft.com/en-us/library/office/bb397403(v=office.12).aspx