Share via

How to Detect Who Deleted a File on Your SharePoint

  • Article

**Why It Is Important
**
Inappropriate deletion of files from your SharePoint site performed either by outsiders or internal users can lead to data loss. Therefore, it’s critical to identify the name of the account that was used and investigate whether an internal user deleted the file, or whether the user account was taken over by a hacker or malware. With that information, you can respond appropriately — for instance, by limiting the user’s access to sensitive data stored on SharePoint, or stopping malware activity in a timely manner.

**Native Auditing
**
1. Navigate to Site Settings → Site Collection Administration → Site collection features → Choose “Reporting” → Press “Activate”.

2. Navigate to Site Settings → Site Collection Administration → Site collection audit settings → Mark “Deleting or restoring items” → Click “OK”.

3. Navigate to Site Settings → Site Collection Administration → Audit log reports → Deletions → Open the generated report in Microsoft Excel.

https://img.netwrix.com/landings/howtofriday/15/Native_File_on_Share_Point.png

  1. Real Life Use Case: View

  2. Credits: Originally posted - https://www.netwrix.com/how_to_detect_who_deleted_file_on_sharepoint.html