For the last 2 weeks NT AUTHORITY\authenticated user permissions of my site collection is deleted every 1-2 days. Everyday I have to check the permissions and create new one if it is deleted. I have no idea about the reason, maybe a policy or maybe another user that have rights is deleting that. How can I learn which user is deleting that permission?

Enable auditing on the site collection and it should tell you who has been making changes. At the worst case, you should be able to look at the IIS logs to see who requested the permissions page and track that back via either username or IP depending on what you have enabled for logging. Regards John Timney http://www.johntimney.com/blog