Sharepoint - User deleted large number of random files.

[Dan2025]

Hi,

 

Had a very weird issue first thing this morning and discovered it when a staff member came to me saying some files were missing in SP, I found these via our 365 backup rather than wade through the recycle bin.

 

I checked the recycle bin after and realised a lot of folders/documents had been deleted all by a single user. All at the same time but no 'top level' folders.

 

Looked completely random but also physically impossible for the user to do it by accident or hell even intentionally.

 

I can't see any suspicious logs for the user in azure but did reset their password.

 

The user said they added this document library(One folder deep) as a shortcut to their Onedrive on friday.

 

This morning around the time it happened they logged onto their desktop.

 

I'm assuming it was the new shortcut but why on earth would that take priority and delete literally 200+ folders..

 

any ideas?

Edited April 24, 2023 by Danwinchelsea

[psydii]

The closest we've seen like that is where the user (unwittingly) moves or deletes from explorer a sync'd copy of the files.

 

Is there any chance there is some other sync agent also running against the user's files (legacy Offline Files, FSLogix, roaming profiles?) that may have tripped things up?

[Dan2025]

Hi Psydii,

Not that I can think of, just the home drive. Senso/Active backup of Sharepoint/Onedrive but that doesn't include the shortcuts after checking. He also has two other shortcuts from other document libraries but neither of these had an issue. (Likely setup a while ago though)

 

He is one of a select few users that have the 365 apps version of office and I've recently noticed we have the enterprise monthly updates. So our version of Onedrive for these users is part of the insider programme I think? I.e my ver is 23.071.0402.0001 Wondering if that might be a possibility..

[DaveTheTech]

If its a shortcut that has been added to their documents folder, users go 'I don't need this in my documents' and delete it.

Not knowing that its synced.

[Dan2025]

If its a shortcut that has been added to their documents folder, users go 'I don't need this in my documents' and delete it.

Not knowing that its synced.

 

Initially I thought it might have been that but for him to delete 200+ folders/ documents within the minute/two it had listed when none of the deleted folders were top level or even 2nd or third level.

 

A good 20-30 folders were deleted in the format below for instance.

 

Folder - Pupil Name a-q - Pupil name - Folder - Deleted folders.

 

It wasn't just stuff that had recently been done either, some of the deleted stuff was months old but some new stuff remained etc.

 

My current guess is when he logged in, his OneDrive sync hadn't finished syncing from Friday when he shutdown (we use files on demand) it then for some bizarre reason decided to be the dominant sync and delete everything it didn't have.