Configure Audit Settings for SharePoint 2013 Sites using PowerShell

Audit log feature in SharePoint helps us to analyze how SharePoint contents are being used by users or to track documents and users in accordance to compliance requirements. SharePoint 2013 audit log configuration is explained in my another post: Configuring Audit Logs Feature in SharePoint 2013 . Lets see how to enable auditing feature in SharePoint 2013 using PowerShell.

Add-PSSnapin Microsoft.SharePoint.Powershell -ErrorAction SilentlyContinue

$SiteCollURL="http://intranet.crescent.com"

#Get the site collection
$Site = Get-SPSite $SiteCollURL

#Define Audit Events
$AuditLogEvents = "Delete", "Update" 

$Site.Audit.AuditFlags = $AuditLogEvents
$Site.Audit.Update()

#Set Trimming Options
$Site.TrimAuditLog = $true
$Site.AuditLogTrimmingRetention = 10

Configure Audit log Settings for All Sites in SharePoint 2013

$WebApp = Get-SPWebApplication "http://sharepoint.company.com"
$AuditMask = [Microsoft.SharePoint.SPAuditMaskType]::Delete -bxor [Microsoft.SharePoint.SPAuditMaskType]::Update -boxr [Microsoft.SharePoint.SPAuditMaskType]::SecurityChange

$WebApp.sites | % {

$_.TrimAuditLog = $true
$_.Audit.AuditFlags = $auditmask
$_.Audit.Update()
$_.AuditLogTrimmingRetention = 30
}
}

For all available audit masks, refer MSDN: https://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spauditmasktype.aspx