none
Get the user information who deleted the site collection RRS feed

  • Question

  • Hi,

    A site collection is being deleted frequently, and we are restoring it through the powershell command "restore-spdeletedsite"
    How can we get the information as to who is deleting the site.

    Please advise

    Satyam

    Monday, January 26, 2015 6:29 PM

Answers

  • Through the browser interface, users may have access to delete the root site of a site collection via the "deleteweb.aspx" page. (Note that site collections can only be properly deleted via Central Administration). If someone is going to the deleteweb.aspx page and deleting the site, you should be able to locate this activity in SharePoint's ULS logs.

    Before you do that, you may want to confirm that SharePoint isn't deleting the site collection itself. In Central Administration, on the Application Management page, choose "Confirm site use and deletion" under "Site Collections."  Select the web application in which the site is being frequently deleted, and verify that automatic deletion is not enabled for that web application.

    • Marked as answer by Satyam Nityam Monday, January 26, 2015 8:58 PM
    • Unmarked as answer by Satyam Nityam Monday, January 26, 2015 8:58 PM
    • Marked as answer by Satyam Nityam Thursday, January 29, 2015 9:22 PM
    Monday, January 26, 2015 8:36 PM

All replies

  • Through the browser interface, users may have access to delete the root site of a site collection via the "deleteweb.aspx" page. (Note that site collections can only be properly deleted via Central Administration). If someone is going to the deleteweb.aspx page and deleting the site, you should be able to locate this activity in SharePoint's ULS logs.

    Before you do that, you may want to confirm that SharePoint isn't deleting the site collection itself. In Central Administration, on the Application Management page, choose "Confirm site use and deletion" under "Site Collections."  Select the web application in which the site is being frequently deleted, and verify that automatic deletion is not enabled for that web application.

    • Marked as answer by Satyam Nityam Monday, January 26, 2015 8:58 PM
    • Unmarked as answer by Satyam Nityam Monday, January 26, 2015 8:58 PM
    • Marked as answer by Satyam Nityam Thursday, January 29, 2015 9:22 PM
    Monday, January 26, 2015 8:36 PM
  • Hi 

    You can write event receiver on a site was deleted and log to custom db or txt file.


    Regards,

    Rajendra Singh

    If a post answers your question, please click Mark As Answer on that post and Vote as Helpful http://sharepointundefind.wordpress.com/


    Tuesday, January 27, 2015 6:34 AM
  • try this link:

    http://sharepoint.stackexchange.com/questions/89913/how-can-i-find-out-who-deleted-my-site-collection-in-sharepoint-online-2013

    --------------------------------------------------------------------------------------------------------------------------------------

    Please mark answer as correct if it is correct else vote for it if you find it useful Happy SharePointing

    Tuesday, January 27, 2015 9:25 AM
  • try this link:

    http://sharepoint.stackexchange.com/questions/89913/how-can-i-find-out-who-deleted-my-site-collection-in-sharepoint-online-2013

    This does not seem relevant for a number of reasons:

    1. It's for SharePoint Online 2013, not SharePoint 2010
    2. At the moment, the accepted answer only explains how to restore the site using powershell, which Satyam already knows how to do.
    3. The only other answer erroneously suggests that site deletion events are captured in the site collection audit settings. In fact, the only site-level events that are captured by auditing are "Editing content types and columns," "Searching site content," and "Editing users and permissions"

    A custom site deleting event receiver, as RajendraPratap Singh suggests, could work well to capture future deletion details, but will not help you retroactively determine who deleted a site. For that, you'll probably want to check the ULS or IIS logs before they get cleared out, checking to see who accessed the "deleteweb.aspx" page at the time the site was deleted.

    You can use the PowerShell cmdlet get-spdeletedsite to determine the time at which the site was deleted, making it easier to find the corresponding entries in the logs.


    • Edited by thriggle Tuesday, January 27, 2015 6:40 PM
    Tuesday, January 27, 2015 6:40 PM