How to track permission changes

Permissions of users have changed without apparent reason.

In fact there is no a mechanism in LMS or SharePoint that changes any permissions on its own.

It is most likely that somebody has changed permissions manually.

You can track permission changes using audit log reports. But you have to enable this feature before the permissions are changed.

So what I can advise is to enable this feature on several courses and wait when you notice permissions swap again.

Use audit report logs for these needs. It is a standard SharePoint feature which can be enabled by activating “Reporting” feature in course site-collection features.

After activating you should be able to see "Audit reports log" in Site settings under Site Collection Administration section.

Afterwards in Site Settings go to "Site collection audit settings", enable “Editing Users and Permissions”.

At this point you have to wait till the issue occurs again.

Once you notice permission issue go to Site Actions -> Site Settings.

1. open Audit log reports -> choose Security Settings report -> choose where to save report (you can use Documents library) -> Ok -> Click the link to view the report.

2. In the Excel file, double click “Grand Total” row and column crossing: http://screencast.com/t/fPAoq9U8
   
   3. Pay attention to “Security Group Member Delete” and “Security Group Member Add” events (these are events of adding and removing users from permission groups). 
   “User ID” column shows who made a change, “Event Data” column shows user ID to whom the change was made.
   http://screencast.com/t/UPH7SQmu83Bz
   To open user’s profile by its ID use the following trick – append to the course URL following suffix:
   /_layouts/userdisp.aspx?ID=1&force=1
   where replace ID with the ID from the column “Event Data”.

For instance full URL will look like: http://spd/courses/course001/_layouts/userdisp.aspx?ID=1&force=1