BO4 - Auditing - showing user logged in though account been disabled for months

[former_member272336]

Hi,

We are using the bo4 audit universe from the sdn forums as recommended in other posts.

One of accounts is disabled but when run user report for last login by username, this one shows as having events couple of days ago.

User concerned was a power user so would have set up schedules but since account disabled would have thought by limiting to event type logged on woudl not see their name.

Anyone know why this would be the case?

Thanks

[Henry_Banks · Accepted solution]

Hi,

So are schedules still up and running with that username?  did you confirm?

perhaps also check for universe connections that have hardcoded usr/pwd in the connection string.

regards
H

[former_member272336 · Accepted solution]

Hi,

Thanks for reply.

Is there a way to determine if schedules set up and running with that username and would this register as a logon event.

Only 1 universe connection and no reference to anay individual usernames in that i.e. just the oracle schema name rather than the bo login name.

Thanks

[CdnConnection · Accepted solution]

Philip,

    You can use Query Builder to run query against CMS to check for schedules owned by disabled user.

Regards,

Ajay

[former_member272336 · Accepted solution]

Thanks for reply.

If user has schedule under their name, whenever the report runs does that register as a login event as that user.?

If this is the case,  is there a way to limit looking for user activity to actual user logged into run a report rather than a schedule ran which they had set up and which runs.

[CdnConnection · Accepted solution]

Philip,

     Did you try to use Instance Manager to search ALL schedule instance by Owner.

You should be able to:

• PAUSE and recurring job in the Queue
• Delete any recurring job
• view location
• View type of Object being scheduled
• even reschedule in required

Regards,

Ajay

[former_member272336 · Accepted solution]

Thanks - user doesn't appear to have any scheduled jobs.

[CdnConnection · Accepted solution]

Philip,

     You will need to find out what types of action, objects are being access using the Audit report. I would also still suggest use Query Analyzer to help understand what objects still exist that are owned by the disabled userID.

Regards,

Ajay