I've not tried fn_dblog on Express but if it is available the following will give you delete operations: SELECT * FROM fn_dblog(NULL, NULL) WHERE Operation = 'LOP_DELETE_ROWS' Take the transaction ID for transactions you're interested in and identify the SID that initiated the transaction with: SELECT [Transaction SID] FROM fn_dblog(NULL, NULL) WHERE [Transaction ID] = @TranID AND [Operation] = 'LOP_BEGIN_XACT' Then identify the user from the SID: SELECT * FROM sysusers WHERE [sid] = @SID