How to find out who ran the TFS Destroy Command?
I have reason to believe that the TFS Destroy command was run on my server. Does TFS provide a way to find out who and when it was done? TFS logs all user-initiated commands in the database for 14 days. Try connect to your Tfs_Collection database and run the following query: SELECT * FROM tbl_Command WITH (NOLOCK) WHERE Command = 'Destroy' Additionally, any time a Destroy command is run, an event is logged to the Application Event Log on the Application Tier that processed the command. I guess this is related to your earlier question. I don't think TFS provides an easy way (or any way) to do