Search code examples
tfsauditdestroy

How to find out who ran the TFS Destroy Command?

I have reason to believe that the TFS Destroy command was run on my server. Does TFS provide a way to find out who and when it was done?

Solution

  • TFS logs all user-initiated commands in the database for 14 days.

    Try connect to your Tfs_Collection database and run the following query:

    SELECT * FROM tbl_Command WITH (NOLOCK)
WHERE Command = 'Destroy'

    Additionally, any time a Destroy command is run, an event is logged to the Application Event Log on the Application Tier that processed the command.