SharePoint site security: how can I programmatically monitor changes?

Question

I have a case where if a SharePoint site owner decides to break permissions inheritance and directly manage site membership, I'd also like to correspondingly modify view permissions on items in a specific list in the top-level site. How can I best catch those changes so I know when to apply the appropriate changes to the list items? I'd like to have some C# code be notified when a site's permissions are changed so I can programmatically modify the appropriate list item permissions.

Answer 1

The best way to do this (unfortunately) is to periodically query all of the sites and check to see if inheritance is disabled. I had a similar problem and used powershell scripting to create a report on site security. If you haven't used Powershell before, don't be intimidated. The syntax is VERY similar to C#.

Answer 2

You can use SharePoint auditing to monitor permission changes. It will track changes down to item level. The downside is that you have to turn this feature on and it will hurt performance somewhat.

As for notification, I don't think auditing tells you about changes. I'm pretty sure you would need to poll the audit log.

There's heaps of information about auditing in this article on MSDN.

Answer 3

Another approach which I think might do a very good job of this is to use the SharePoint ChangeLog. Bascially, this is used by SharePoint during indexing, with the log telling the gatherer exactly what has changed, and what should be indexed during an incremental crawl.

When you have a permission change, then this should be picked up during an incremental crawl. The ChangeLog has specific parameters that can be passed to identify changes to permissions. Take a look here at the SPChangeQuery Class:

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spchangequery.aspx

Specifically you can look for ChangeTypes: http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spchangetype.aspx

Including: AssignmentAdd AssignmentDelete MemberAdd MemberDelete ...and more