How to find the Last logon detail of a deleted user?

[Former Member]

I need to find the last logon detail of a deleted user.I have tried with SM20 i got the details,but i coildnt get for few users.Is there any other way to get this?

[magexposito]

Hello Eva,

On transaction SUIM there is an option to find the last logon information of an user.

SUIM --> User Information System --> User --> By Logon Date and Password Change

The only problem is that I not completely sure if it will work with a deleted user. Otherwise you can recreate the user and try.

Best regards.

[Former Member]

Hi,

Thanks for your reply.

Ok ill try to create an OSS msg. If u came to know any other way,Kindly let me know.

Thanks Again.

[Sriram2009]

Hi Eva

You can find the information using the transaction code SU01, type the deleted user id and select the from the menu "Information" and then select "Change Documents for user" refer the snapshot

BR

SS

[Former Member]

Hi,

USH02 gives the details of existing users only.I need for the deleted user.

Regards,

Eva

[Former Member]

Hi,

Im getting the result in USH02 but its not correct.

Regards,

Eva

[Former Member]

Hi Eva,

The details seen in USH02 are only for deleted user and with KRNL method one can say the last login details. so this is much of a information can be obtained for the SAP.

May be if you need more insight & detailed one. You might have to raise a OSS message for same.

Regards,

Ram

[Former Member]

Hi,

Thanks for your reply.

Ill share u a snap shot in tat the user is z012499.

His last logon date was 6.1.2015 as of SM20.

But in USH04 its showing the last mod.date was 25.7.2014.

[Former Member]

Hi Eva,

Table USH04 will give details regarding Profiles modifications.

Try USH02 for user related details.

Regards,

Ram

[Former Member]

Hi,

Can u tell me the steps little more clearly,

1.se16

2.USH04

Remainings pls

Regards,

Eva

[Former Member]

Hi Eva,

Follow below:-

1. Go to Se16

2. table name either USH02 or USH04

3. provide BNAME row as your user name then execute it

4. you will get all the entries for that user in the next output screen

5. Check the Column names like

MODDA

MODTI

MODBE

TCODE REPID

For the Details which you need.

The descriptions of this columns are as below:-

MANDT	Client
BNAME	User
MODDA	Modification date
MODTI	Modification time
MODBE	Changed by
TCODE	Not More Closely Defined Area, Pos
REPID	Program Name
BCODE	Initial password
GLTGV	Valid from
GLTGB	Valid through
USTYP	User Type
CLASS	User group
UFLAG	User Lock Status
ACCNT	Account number
PASSCODE	Password Hash Val.(SAH1, 160 Bit)
CODVN	Password Code Vers.
PWDINITIAL	Indicator: Password Is Initial

Let me know if you need further help in this.

Regards,

Ram

[Former Member]

Hi eva,

For USH04

Table below are the details of the Column fields.

MANDT	Client
BNAME	User
MODDA	Modification d
MODTI	Modification t
MODBE	Changed by
NRPRO	Number of prof
PROFS	User profiles

Regards,

Ram

[Former Member]

Hi,

RSUSR200 with this t code i could get the logon details of existing users oly.dot the deleted users

USH02-Gives the last modification of the user but not the last logon detail

USH04-Gives the details about when the user ID has been deleted.

Using SM20 I ve got the last logon detail of the deleted user,but I couldnt get for few users.

I need the details same as of SM20.

Regards,

Eva

[Former Member]

Hi Eva,

When user is deleted its entries are moved from USR02 to USH02. And from USH02 with TCODE KRNL and REPID SAPMSYST you can get the last login date time stamp.

And you will not get the details as same as SM20 format as this are Table level.

And if you want for last 24 hours you can use STAD t-code. But it will give you only last 24 hours only.

Regards,

Ram

[Former Member]

Hi,

Ya I have tried tat and i got it,but for few user's I am getting.

Regards,

Eva.

[Former Member]

hi Eva,

also you can Try to execute the report RSUSR200 to check for the user data.

you will find the last logon of the user and that will.

Also you can check table at USH02 / USH04 for the deleted user, there will be an entry of the last logged in date, including the last time.

In the last date entry, check for user with entry to tcode: KRNL and Program: SAPMSYST.

SAP writes this entry form USR02 to USH02 before it deletes the record for the user.

Please find below thread for more reference.

Regards,

Ram

[Former Member]

Hi,

I ve tried but I didnt get...For currently available users I am getting it but not for deleted user.

I need it for the deleted user's last logon detail.

[Former Member]

Hi Eva,

Have you tried to check the SM20 audit logs too for same user.

Regards,

Ram

[Former Member]

Hi Eva,

Try the Change Documents option in SU01 for the user where you can find the lastlogin details of the user.

Regards,

Ram