问题
I have reason to believe that the TFS Destroy command was run on my server. Does TFS provide a way to find out who and when it was done?
回答1:
TFS logs all user-initiated commands in the database for 14 days.
Try connect to your Tfs_Collection database and run the following query:
SELECT * FROM tbl_Command WITH (NOLOCK)
WHERE Command = 'Destroy'
Additionally, any time a Destroy command is run, an event is logged to the Application Event Log on the Application Tier that processed the command.
回答2:
I guess this is related to your earlier question. I don't think TFS provides an easy way (or any way) to do this. You can however narrow down the list of suspects, only users in the "project administrator" or "project collection administrator" groups have permissions to do a destroy. Contributors will get an error message if they run tf destroy. It does seem a bit of an oversight that this action isn't audited so hopefully someone will add an answer that allows you to get to the bottom of this.
来源：https://stackoverflow.com/questions/9185018/how-to-find-out-who-ran-the-tfs-destroy-command