Users removed from accessing the library

[ronnynch]

Hi All,

I would like to ask if there is a log captured when a user access has been removed from a library or a user group? I have user reported that he suddenly not able to access to a library. Upon checking, it is confirmed that his does not have access to the library. Issue is, he insists that he has the access to the library previously.  Do metadata logs capture the event where the user access was removed?

Thanks.

[carl_sommer]

(I assume you mean metadata permission changes, not file system or database system permission changes)

A great reference for this is the following SAS Global Forum paper from 2009:

Using SAS® 9.2 Metadata Security Reporting and Auditing Features

What you are most likely interested in is the Audit.Meta.Security.GrpAdm logger (which would note if a user was removed from a group, which would be how the access would be lost of the user was removed from a permitted group) , or the Audit.Meta.Security.AccCtrlAdm logger (which would be a directed change of permissions on an object, perhaps the folder that this table inherits permissions from)

For more details on metadata server loggers, see SAS Help Center: About Metadata Server Loggers

This paper also talks about using the %MDSECDS Security Report Macro to audit security changes.

Carl Sommer - SAS Technical Support

[Sajid01]

Yes.
Typically changes to metadata server are captured in the metadata server logs.