Track Record Deletions

###Set up the database for tracking record deletions

This section explains the steps necessary to set up each Privilege Set for tracking record deletions.

Note: The Record Privileges for the [Full Access] Privilege Set cannot be modified, therefore any user logging in with the [Full Access] Privilege Set will be able to view and delete records without being audited. The best practices for security in FileMaker Pro say to not have anyone logging in with the [Full Access] Privilege Set anyway, so you should consider creating a new Privilege Set with the options defined below and then apply it to your users that are currently assigned the [Full Access] Privilege Set.

1. Open up the Accounts & Privileges / Manage Security dialog.
2. Switch to the Privilege Sets tab and edit the first custom privilege set. If there are no custom privilege sets, highlight the [Data Entry Only] privilege set, press Duplicate, and then edit that new privilege set.

3. In the Data Access and Design section, press the Records drop-down menu and select Custom Privileges.

4. In the Custom Record Privileges dialog that pops up, select the first table.
5. Press the Delete drop-down menu and select limited....

6. In the Specify Calculation dialog that pops up, change the View drop-down to External Functions.

7. In the list of functions, scroll down until a line for CNSAudit_RecordDelete is visible and double-click it.
8. Determine if your database will only be used by client versions of FileMaker Pro 11 or above:
   
   a. If so, replace the TableName parameter with the Base Table Name of the table you are editing the privileges of.
   b. If not, specify any Table Occurrence Name of the table you are editing the privileges of. (At the top of the Specify Calculation dialog is the Evaluate this calculation from the context of setting. You can use the same Table Occurrence name in your calculation as is selected in that setting.)
9. Press OK to close the Specify Calculation dialog.
10. Repeat steps 5-9 for each table in the Custom Record Privileges dialog. (Once the CNSAudit_RecordDelete function has been added to one calculation, copy and paste it to the other ones, or just retype it, and skip selecting the External Functions repeatedly. Make sure you update the TableName parameter for each table, though.)
11. Press OK to close the Custom Record Privileges dialog.
12. Press OK to close the Edit Privilege Set dialog.
13. Repeat steps 3-12 for each custom privilege that needs modifying.
14. Switch to the Accounts tab and reassign Privilege Sets to the Accounts as necessary.
15. Press OK to close the Accounts & Privileges / Manage Security dialog.

Once these Custom Record Privileges are set up, the plug-in will be able to track record deletions which are stored in the CNS Audit Log table. The CNSAudit_RecordDelete function will also cause the record to be audited before it is deleted if it has never been audited before. The audit actually occurs whether the user actually deletes the record or if he or she presses Cancel on the record deletion confirmation dialog.