Where do I find logs of changes to the group membership?

[Don Tanner]

Where do I find logs of changes to the group membership?

[Mike Allen · Accepted solution]

OOB, it is not audited.   I don't know that you can even turn on auditing to see it.   It shows up in the Deleted Records module, under XML.

[Don Tanner]

That's too bad.   Had a bunch of users removed from the ITIL group and nobody is claiming responsibility.

Thanx for the quick response.

[Jim Coyne]

Like Mike mentioned, you can check the "System Definition \ Deleted Records" module to see who deleted the records.   You will want to filter the records where Table name is "sys_user_grmember" and where the Payload contains the group name:

Add the "Record deleted" and "Created by" fields to the list view and you should be able to track down the culprit