Here is another question that can be solved by leveraging vCenter Server Events, which provides a lot of useful information, especially for historical operations and auditing purposes. Simliar to identifying where a VM was cloned from use case, we can also use vCenter events to retrieve the historical events for all VM deletions for a given vSphere environment.

One important thing to note is that when a VM or any other vSphere object for that matter that has been deleted, all references to that object is removed from vCenter Server. This means, we can not look for events for a give VM but instead, we need to look at the Task-based Event types to actually retrieve this information.

Putting this together, I have created a PowerCLI function called Get-VmDeleteHistory which can be installed directly from the PowerShell Gallery by running:

Install-Script -Name VmDeleteHistory

After connecting to your vCenter Server using the Connect-VIServer cmdlet, you can then run the Get-VmDeleteHistory function which uses the Get-VIEvent cmdlet and looks at the last 500 events. Below is an example output of what you will see which is the VM that was deleted, the User who performed the action along with the date and time.

If you want to look further back in history, you can provide the optional -MaxSamples parameter and that will allow you to specify the maximum number of events to look through.

Get-VmDeleteHistory -MaxSamples 1000

It is also important to understand that how far back you can go is based on your vCenter Server's Task/Event retention configuration.