We have an on-premise installation of Dynamics 2011. A user noticed 12 appointments missing from an appointment list. The audit log in CRM showed the 12 records were deleted (after hours on a Saturday).
From Windows server logs we can see that user account that deleted the records logs in and out almost every minute through out the day the records were deleted. (The actual user wasn't using the account)
We have changed the account password and restored the records but I don't know why they were deleted? Does anyone have suggestions for how I could investigate this further.
Thank you.