SharePoint 2010: Who is deleting my workflows??!!

Problem: The issue was that someone with SharePoint Designer access deleted some workflows. No one stepped forward to claim responsibility so I was tasked with trying to track down who did and provide a solution to prevent this. A quick side-bar, this is why I recommend a training curriculum for your users BEFORE they are granted access to SharePoint designer, but I digress.


Since this is the page that contains the code to delete workflows, we now had a place to start: RemWrkfl.aspx. I figured this out by deleted a workflow, recording the time, then looking through the IIS logs

The user did the same on their side and was able to identify the user who deleted the workflows by doing a search for 'RemWrkkfl.aspx' during the time of the incident. It will display the account name next to this action in IIS