Wednesday, 5 November 2014

Auditing of Export to Excel in Dynamic CRM 2011/2013

Few days before I had a request from a customer that whether it is possible to find out what data(might be confidential) has been exported by a user on a specified date (for tracking or to catch culprit) on a specified date or over a period of time…
The  first thing which came into my mind was to restrict them access to “Export to Excel” on his corresponding security role but what happens to the data already exported, how to know what data was exported and stuff’s.

By done lot of Research i have found a way to get user who has exported data from CRM. Here below is the way for the same :

If you're familiar with IIS, you probably already know how to find the location of the log files, but I'll give a quick recap for those who are not. On the Microsoft CRM server, open the Internet Information Services Manager and find the Microsoft CRM website. Right-click on the website and select Properties. The following dialog will open.





Then select the Properties button, and this window will open





From here you can see that the log file directory is c:\WINDOWS\system32\LogFiles\ and the folder for this Microsoft CRM website is W3SVC1 (but yours might be different). Now launch Windows Explorer and browse to this directory. You will see a bunch of files in this folder (one for each day) named with the exyymmdd.log naming convention.

Open any of these files with the text editor of your choice. Then search in the file for the text "mode=export". If someone exported data to Excel during that day, you'll see a line that looks something like this::






The viewid of =%7BE35F1FC9-9450-455B-8F2A-5B59BA193706%7D
The IP address of 192.168.252.200
One way to determine which view of data that the viewid relates to is to browse to (entering in the name of your Microsoft CRM server and the viewid you retrieved from the IIS log file):



If you copied and pasted correctly, then you'll see the view editor for the view that a user exported! For example, if you see the view editor for the Active Leads view then you know that a user exported the data from the Active Leads view. Now that you know what data was exported, you can use the IP address to determine which computer/user did the export.



Hope this will someone !!!!! Enjoy :)

1 comment:

  1. Special thanks to (hackingsetting50@gmail.com) for exposing my cheating husband. Right with me i got a lot of evidences and proofs that shows that my husband is a fuck boy and as well a cheater ranging from his text messages, call logs, whats-app messages, deleted messages and many more, All thanks to

    (hackingsetting50@gmail.com), if not for him i will never know what has been going on for a long time.

    Contact him now and thank me later.

    ReplyDelete

Blogger Widgets