What user or process deleted an item from the console?

book

Article ID: 170768

calendar_today

Updated On:

Products

Management Platform (Formerly known as Notification Server)

Issue/Introduction

Occasionally we need to find what user or process deleted an item from the console.  Here are some suggestions.

Resolution

A couple places to look:

select * from Evt_NS_Item_Management m
where m.ItemName = '<computer or other object>'

select * from ItemDeleted d
where d.ItemName = '<computer or other object>'