User Accounts Deleted

Sharon Parry asked on July 13, 2020 00:23

I have just spotted in the Event Log for this site that about 20 user accounts were deleted within the last hour. The event details are as per below, however I can't find any Scheduled task that would do this. I've searched both global events and site-specific events, and the only scheduled task I can see that looks anything like this the "Delete inactive contacts" which isn't enabled anyway (and hasn't been run since 2017). Even sorting the scheduled tasks by the "Last run" date/time, there is absolutely nothing that ran plus or minus 5 minutes of the time the Event log reports that these accounts were deleted.

These user accounts should never by deleted automatically by a default scheduled tasks. Most of them are employee records which need to be maintained even after the employment has ceased and the account has been disabled.

What scheduled tasks did this, and how can I disable it permanently?

Extract from Event Log

Event ID:368979

Event type:Information

Event time:13/07/2020 7:15:13 AM

Source:User

Event code:DELETEOBJ

User ID:65

User name:public

IP address:xxx.xx.xxx.xxx (the website's IP)

Description:Delete User 'XXXXXX'

Machine name:XXXXXXXX

Event URL:/CMSPages/scheduler.aspx

URL referrer:

User agent:

Recent Answers

Brenden Kehren answered on July 13, 2020 01:02

Contacts are not users. User accounts are used for authentication and only relate to contacts.

I believe there is a scheduled task (disabled by default I believe) that removes users if not activated.

0 votesVote for this answer Mark as a Correct answer

Sharon Parry answered on July 13, 2020 01:09

Hi Brenden,

Yes, understand the difference between Contacts and Users, but can't find what "scheduled task" would have deleted these users. And, besides that, they were all "activated" user accounts anyway. One of them was actually a personal account in my own name that I use for testing - have logged in and used that account many times over the years, although I probably haven't used it for the last couple of months.

The only setting I can find (ie, Setting rather than Scheduled Task) is "Delete nono-activated user after (days)", but that has got nothing recorded (ie, no "days" value recorded).

0 votesVote for this answer Mark as a Correct answer

Juraj Ondrus answered on July 13, 2020 14:47

Is there any staging or importing going on? the user accounts could have been deleted also when staging the delete tasks or, when importing some package which contained the delete tasks from the other environment.

0 votesVote for this answer Mark as a Correct answer

Sharon Parry answered on July 13, 2020 21:07

Hi Juraj,

No, there is no staging at all. The only importing that has occurred recently is some custom tables that I developed in my local project, exported, and then imported (without data) into the live site. Apart from that, the only other thing that has happened recently is I applied hotfix 51 on 17th June.

0 votesVote for this answer Mark as a Correct answer

Juraj Ondrus answered on August 4, 2020 08:38

Isn't it possible that when importing the custom tables, there were also imported the "delete tasks" from the source environment?

0 votesVote for this answer Mark as a Correct answer

Sharon Parry answered on August 4, 2020 21:52

Hi Juraj,

I've JUST discovered what I think caused these deletes.

This site has multiple (more than 30) sites as sub-domains. I'm just in the processing of setting up a new additional site, and as part of that process discovered at Step 3 the "Scheduled tasks" item, with "Users delete non activated user" which is checked by default. Checked a few of the existing sites for that site-specific scheduled task, and YES, it is enabled for some of them!

These sites have been running for a number of years, and this has never happened before. As I said up above, the only other thing that has happened was that Hotfix 51 was applied approximately 1 month prior to my discovering the problem.

0 votesVote for this answer Mark as a Correct answer

   Please, sign in to be able to submit a new answer.