How to find out who ran the TFS Destroy Command?

Question

I have reason to believe that the TFS Destroy command was run on my server. Does TFS provide a way to find out who and when it was done?

Answer 1

TFS logs all user-initiated commands in the database for 14 days.

Try connect to your Tfs_Collection database and run the following query:

SELECT * FROM tbl_Command WITH (NOLOCK)
WHERE Command = 'Destroy'

Additionally, any time a Destroy command is run, an event is logged to the Application Event Log on the Application Tier that processed the command.