I have see a strange issue a few times at my client. They are using SharePoint Online and mainly using the syncronisation option to sync the files locally using OneDrive.

Sometimes files are deleted from SharePoint seemingly by the user - even if the user wasn't working that particular day.

The latests case is a few files edited the 15th. The user saves the files and leave work only to come back the 19th. Now back at the office this monday (19th) the files are gone from both Onedrive and SharePoint. The files can be found in the recycle bin, marked as deleted by the user the 16th (very early morning). Knowing the user he for sure wasn't working that day, and most cretainly not at that time. The pc was shut down and stayed in the office.

Unfortunately auditing hasn't been turned on for the site collection.

Does anybody have any idea what's causing this?

  • Is there any policy of the company which wipes data from the drive every weekend? Nov 21, 2018 at 7:41
  • No there's not any policy like that :-/
    – Morten K
    Nov 21, 2018 at 8:17
  • Are you using physical PC or VDI infrastructure, was there any image rebuild done? Nov 21, 2018 at 8:47
  • Physical PC no image rebuild. The entire setup is vary old school :)
    – Morten K
    Nov 21, 2018 at 8:51

1 Answer 1


Unfortunately, the stamp regarding recycle bin is worth nothing.

OneDrive always works in the name of the user you are logged in with, therefore any change to files - in your case moving them to the local computers recycler - will be done in the users name.

SharePoint Online itself does not show WHO deleted a file. I still found no reliable solution to figure out who in fact deleted a file originally. So looking for a solution here is not that simple, doesn't have to be the user/system you are checking.

Whenever we encounter these things happening again and again after explaining all users the facts regarding what happens when i delete a file in OneDrive and how to "de-sync" it properly we meanwhile created a permission group we call "Restricted Contribute". Quite the same as "Contribute" but without delete permission. You still can add and edit content/files but delete doesn't work. This is then applied to the whole library until THE user comes in with “I can not delete my file” what usually leads to the one who not yet understood how OneDrive works and needs an explanation. ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.