How to find which user deleted a virtual machine's vmdk on vSphere Web Client
search cancel

How to find which user deleted a virtual machine's vmdk on vSphere Web Client

book

Article ID: 394459

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

This article outlines the steps to identify which user deleted a VMDK from a virtual machine using the vSphere Web Client. 

Environment

VMware vCenter Server Appliance 7.x
VMware vCenter Server Appliance 8.x

Resolution

Steps to Identify the User Who Deleted a VMDK via vSphere Web Client:

  1. Log in to the vSphere Web Client.

  2. Select the impacted virtual machine.

  3. Navigate to the “Tasks” tab.

  4. Locate the timestamp corresponding to when the issue was reported.

  5. Look for a "Reconfigure Virtual Machine" event around that time.

  6. Check if the event includes a VMDK deletion. If so, review the Initiator field — this will display the user account that performed the delete operation.

    Example : 

Powered by Wolken Software