Is there a log file some where that keeps a log of what cleints do and changes made when inside the plesk CP? I have a client that had a former employee login under their client account and delete their backups then deleted the domain from the client account so it could'nt be restored. We know she did it i just need to find some proof for the owner and we know the base time when it happened. Just was'nt sure if there is a log that plesk keeps when cleints login to the CP and tracks changes made.

any help would be great.

I think its the action log under plesk. Forgot where it is stored right now.
But it's accessable via CP.
Now thats a good example why IT-/Security-Policies should always be implemented.

Yea i had a mind fart this morning and did'nt think to check the action log until after i had my coffee and made this post. And i agree on the "Now thats a good example why IT-/Security-Policies should always be implemented " and always tell our clients never give full access to employees and if they do to change their information if an employee leaves, get's fired or drops off the planet.