How to get the last log on date for deleted user ids

[former_member211709]

Dear Experts,

Can some one help me how to get the last log on date for deleted user ids, we have tried with RSUSR200 t code but its showing

No matching user found

Message no. 01001

Regards,

Krishna Mohan

[former_member190027]

Hi Krishna,

You can also check in SUIM ---> USERS--->BY LOGON DATE AND PASSWORD CHANGE.

Hope this will be useful to you.

Thanks!

[former_member211709]

Hi Pravithra,

Thanks for the reply,

We have already checked SUIM --> Users --> By Logon Date & Password Change (RSUSR200), but unable to view the details.

[former_member190027]

Hi Krishna,

For deleted users please try the below option.

SUIM ---> Change documents-->users--->

Then put the user Id and select the option as deleted users in the below, please select all tabs except users created in the user attributes and click on technical view and execute.

If the user you have deleted has logged in before then you can see the date & time in this report.

Hope this will be helpful.

Thanks!

Regards,

Pavithra.B

[Former Member]

Hi Mohan,

I hope the below link will help you

http://scn.sap.com/thread/1243245

Regards,

Firoz.

[Former Member]

Hi Krishna,

Go to t-code  SUIM --> Change Documents --> For Users --> remove from date & to date and tick on user created & user deleted tabs on the bottom and execute, it will shows the result

Regards,

Kiran

[Former Member]

Hi Krishna,

You can also check through SM20 logs, this will give you exact information about all activities user has performed (including log in and log off) for the specific time.

Hope this will be helpful.

Regards

Anshul

[martin_voros]

Hi,

SM20 does not have log off events. Only log on events are available.

BTW another reason why it's not a good idea to delete users. It's better to move them to one group and remove all roles and disable account.

Cheers

[Former Member]

Hi Martin,

I have used SM20 many times and I executed this for one user and got the user log off event (see screenshot below).

This seems to be valid log off event.

Could you confirm ?

Regards

Anshul

[former_member202471]

Hi Krishna,

For deleted users the only option you have is analyzing the Security Audit Log (SM20)... please bear in mind that, when a user is deleted the system removes details of that user, also address data.

That's why SAP advise not to delete users, but just deactivate them, remove authorizations and lock them afterwards. So that it would be able to retrieve such information about users which are not used anymore.

Hopefully this will be helpful.

Regards,

Felipe Fonseca