Folder Details
User Activity->Permission Changes
Permission Changes
This category comprises events reflecting permission changes on various data (objects, files, mailboxes, etc.) across the enterprise.
Field Matching
FieldDescriptionSample Value
When At what date and time a user activity originated in the system. 1/1/2000
Who Account or user name under which the activity occured. SomeUser
What The type of activity occurred (e.g. Logon, Password Changed, etc.) Permission change
Where The name of the workstation/server where the activity was logged. 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. 10.10.10.10
Severity Specify the seriousness of the event. High
WhoDomain
WhereDomain
Object Type The type of object whose permissions were changed (e.g. AD object, file, registry, etc.)
Object Name The name of the object whose permissions were changed (e.g. full system path to the file or folder)
To Whom Account whose access permissions to the object were changed