Troubleshoot Deleted Admin Users Still Appearing in the Umbrella Dashboard Logs

Introduction

This document describes how to troubleshoot deleted admin users still appearing in the Umbrella Dashboard logs.

Overview

Occasionally, you might notice these logs appear in Admin Audit Logs. The logs details appear after an admin user is deleted from Umbrella Dashboard or no longer exists in the organization.

23266090126100

Cause

As long as the fingerprint and OrgID values in the orginfo are valid, roaming devices continue to register successfully and our roaming client server continues to report the user account associated with the deleted userID.

This is expected behaviour for auditing.

Resolution

To prevent these logs from client registration, we recommend updating the orginfo.json file deployed to end-devices by downloading a new orginfo from your Dashboard > Deployments > Roaming Computer > Roaming Client in the top-right > Download Module Profile with a current and active admin user account. Once you have replaced the orginfo.json file used for future installations, the Admin Audit Logging shows the Umbrella admin user who downloaded the new orginfo.json file.