locked
MOSS 2007 site deleted RRS feed

  • Question

  • Hello all,

    In my current work location we have a MOSS 2007 intranet environment with more than 10 site collections, but in one of the site collections  few sub-sites were deleted on the same day. We have analysed the IIS logs to find out who deleted the site but there were no deleteweb.aspx or webdeleted.aspx entries for those sites. In addition to that Audit logging was not enabled in the SP application when sub sites were deleted and few users on one of the sub-sites used SP designer where the entries for author.dll could be seen in the IIS logs, but none of the  users claimed the site deletion. 

    We are trying every possible way  to figure out how sub sites were deleted, but no luck. Since the sub sites are on production server with business critical data in it, we cant afford the same thing happening again.. So could you suggest me any possible way to find how the sites were deleted?


    Yashwanth Mannem









    Tuesday, June 19, 2012 1:26 AM

Answers

  • The one thing you can narrow down is to find who has the full rights on those sites if you know them as an admin.

    Aniket

    Wednesday, June 20, 2012 6:00 AM
  • Was the recycle bin been enabled? if so you can find there as well
    Friday, June 22, 2012 10:58 AM

All replies

  • Hi Yashwanth,

    For logging purpose what you can do is register any of SPWebEventReceiver.WebDeleting or SPWebEventReceiver.WebDeleted method of SPWebEventReceiver using feature definition.

    Please check the following links:

    http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spwebeventreceiver.webdeleting.aspx

    http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spwebeventreceiver.webdeleted

    Then log necessary information within the method definition to the log file.

    /// <summary>
           /// A site is being deleted.
           /// </summary>
           public override void WebDeleting(SPWebEventProperties properties)
           {
               base.WebDeleting(properties);
    		   string strUserName = properties.UserLoginName;
    		   // TODO : Write message to log file
           }

    PS : The links above are for SharePoint2010. But the same should work for MOSS 2007 as well. These web events are also supported in MOSS 2007.

    Hope this helps.

    Regards
    Devang Bhavsar




    Tuesday, June 19, 2012 7:36 AM
  • Thanks for your reply Devang Bhavsar. We would definitely consider your valuable suggestion for future troubleshooting, but is there way to find who and how the sites were deleted with our current setup as I mentioned above?

    Yashwanth Mannem

    Tuesday, June 19, 2012 1:33 PM
  • The one thing you can narrow down is to find who has the full rights on those sites if you know them as an admin.

    Aniket

    Wednesday, June 20, 2012 6:00 AM
  • Was the recycle bin been enabled? if so you can find there as well
    Friday, June 22, 2012 10:58 AM