How Can I find out which user deleted site collection in SharePoint 2013?

Question

Before few days ago,we were facing issue while accessing our production site.After debugging further we found that there were zero site collection count in our content DB.We have restored the site collection using Powershell Command Get-SPDeletedSite | Restore-SPDeletedSites

Now we want to find out which user deleted site collection.We checked ULS logs but nothing specific to site collection deletion.

Any help is appreciated...

Answer 1

Their is no easy way to find who deleted the site collection. ULS logs not giving too much information about the site collection deletion. Here are couple of things you can try.

IIS logs analysis

• check the IIS logs on the WFE and try to find the /_layouts/deleteweb.aspx(if deleted from the site collection itself) or /_admin/delsite.aspx(if site collection deleted from Central Admin). I have sucess using this method. But you have to make sure about the date when the site deleted so check the correct date logs.

Another way

• check the event cache table on the content Database and try to search the site collection name. running direct queries again the Content db may put you in unsupported mode. So best thing is take the backup of content db and restore somewhere else then check the db.

Answer 2

It would be difficult to find out the user who deleted Site collection. However you can use Get-SPDeletedSite -ContentDatabase "WSS_CONTENT" to obtain a deleted site collection.Try to find the /_layouts/deleteweb.aspx and /_admin/delsite.aspx. Also check whether automatic deletion of site is not enabled in central admin.

For more information,

Please check the following links,

https://social.technet.microsoft.com/Forums/office/en-US/6423bc37-b320-40ff-b953-f3b8f2d845fe/get-the-user-information-who-deleted-the-site-collection?forum=sharepointgeneralprevious

Trace who and when a site collection got deleted Permanently in sharepoint 2013