Configure Audit Settings for SharePoint 2013 Sites using PowerShell

Audit log feature in SharePoint helps us to analyze how SharePoint contents are being used by users or to track documents and users in accordance to compliance requirements. SharePoint 2013 audit log configuration is explained in my another post: Configuring Audit Logs Feature in SharePoint 2013 . Lets see how to enable auditing feature in SharePoint 2013 using PowerShell.

PowerShell to set SharePoint 2013 Audit Log Settings
To set SharePoint 2013 site collection audit settings using PowerShell, use this script:
Add-PSSnapin Microsoft.SharePoint.Powershell -ErrorAction SilentlyContinue


#Get the site collection
$Site = Get-SPSite $SiteCollURL

#Define Audit Events
$AuditLogEvents = "Delete", "Update" 

$Site.Audit.AuditFlags = $AuditLogEvents

#Set Trimming Options
$Site.TrimAuditLog = $true
$Site.AuditLogTrimmingRetention = 10

Configure Audit log Settings for All Sites in SharePoint 2013
$WebApp = Get-SPWebApplication ""
$AuditMask = [Microsoft.SharePoint.SPAuditMaskType]::Delete -bxor [Microsoft.SharePoint.SPAuditMaskType]::Update -boxr [Microsoft.SharePoint.SPAuditMaskType]::SecurityChange

$WebApp.sites | % {

$_.TrimAuditLog = $true
$_.Audit.AuditFlags = $auditmask
$_.AuditLogTrimmingRetention = 30

For all available audit masks, refer MSDN:


  1. Is there a way to enable Auditing at the list and library level of Information Management Policy Settings?

  2. We are finding that when running this from a ps session from a remote server (non-shareoint)connecting to sharepoint server this does not work.

    Exception setting "AuditLogTrimmingRetention": "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"
    At line:9 char:1
    + $_.AuditLogTrimmingRetention = 30
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [], SetValueInvocationException
    + FullyQualifiedErrorId : ExceptionWhenSetting

  3. hi, thanks for the script.
    how do i set the location to store audit reports

    1. following the blog. appreciate the response

    2. This is not possible, As far as I know..


Please Login and comment to get your questions answered!

Powered by Blogger.