When a Media Item is deleted, the Audit Log reports the initial delete as “Move Media to Recycle Bin performed by user”, correctly ie the audit log records the user who pressed ‘delete’.
But the actual delete action is ascribed to the original creator of the Media Item , not to the User who who pressed ‘delete’. Why is this the case in Umbraco?
Hi @edwin
Welcome to the forum?
Can you let us know which version of Umbraco you are using please?
Justin
Also please provide some screenshots if they make it more clear 
We are using Umbraco 13.13
Hereby the screenshot. As you can see, a delete operation was performed, but it wasn’t initiated by the user. Furthermore, the delete operation was executed immediately after the move operation.
Hi @edwin
So, I’m guessing the move was recorded as the media was moved to the recycle bin by the user, but them Umbraco for some reason logs a delete audit using the original user. I’ve no idea why that is and I can confirm this happens on a v13 site I have, but testing on v17 and it records both the move and the delete as the same current user.
I don’t think there’s anything you will be able to do about this and v13 is in security phase so only security issues will be fixed so there’s no point raising it on the issue tracker.
Justin
Hi Justin, got it, thanks for your respond. Do you happen to know if this has been fixed in Umbraco 17?
Hi @edwin
Yes, I checked on v17 and it shows the move and delete as the currently logged in user.
Justin
