When you submit a request for file deletion, you receive a confirmation in the console that the request was successful. This does not mean that the actual deletion of the file has occurred or that it will be successful when attempted. You can monitor the progress of a deletion request by viewing the Events page, and you can use Alerts to notify you when files are deleted, or when deletion fails.

When one deletion request affects multiple instances of a file, one event appears to report the outcome of the deletion attempt (success or failure) for each instance. This can happen when you request deletion from all computers or you request deletion from one computer and there are multiple instances of the file on that computer.

Table 1. File Deletion Events

Event Type

Event Subtype

Description / Example

Computer Management

File deletion requested

If the request was to delete a file from one computer:

User 'admin' requested file deletion of all instances of [2488C...558F1] from MYCORP\DESKTOP6.

If the request was to delete a file from all computers:

User 'admin' requested file deletion of all instances of [FBAD9...34F00] from 100 computer(s).

If the deletion request came from an Event Rule:

User 'System' requested file deletion of all instances of [81027...576DA] from MYCORP\DESKTOP6.

Computer Management

File deleted

File 'test123.bat' [FBAD9...34F00] was successfully deleted from MYCORP\LAPTOP3

Computer Management

 

File deletion processed (file not found)

If a file is in a computer’s inventory but not on disk:

File deletion processed with file not found for [EDBD7...12F06] from MYCORP\DESKTOP9

Computer Management

 

File deletion failed

If the deletion failed because it was a file from a protected publisher:

File deletion failure of 'emet_gui.exe' [2024F...41CCD] from MYCORP\LAPTOP3. Error: Microsoft File

If the deletion failed because the agent version doesn’t support server-based deletion:

File deletion failure of 'emet_gui.exe' [2024F...41CCD] from MYCORP\LAPTOP3 because this Agent version doesn’t support it.

If the deletion failed because the file is no longer present on the computer and not in its inventory:

File deletion failure of 'tryme.bat' [76C7F...BD915] from MYCORP\DESKTOP8. Error: Delete Error[C0000034]

In addition to actively monitoring the Events page, you can create alerts that will notify you when file deletion events occur. For example, you might create one alert that is triggered when file deletion succeeds and another that is triggered if a requested deletion fails. See Creating Alerts for more information.

You can also check the Files on Computers page to determine whether a file deletion was successful, although if there is a large backlog of file activity, this might take a few minutes.