Disabled internal User have audit log of "logged in via password from 114.10.117.218."

Account and User Management
1

I disabled this user on 15 May since it's an end of working contract.

Screen Shot 2023-06-07 at 16.01.59
Screen Shot 2023-06-07 at 16.01.59870×688 80.6 KB

But see this activity log that the person "logged in via password from 114.10.117.218." on 1 June.

Audit log
Audit log1220×924 102 KB

I'm just want to know what does word "logged in" meant? Like will the user still able to see the pages like he/she used to before disabled. Then isn't the point of disabling user so the person can't logging in again.

2

Hey @Vincent_Lius!

Disabled users won't have access to your org, if they attempt to log in they'll be immediately redirected back to the login page. However, the login attempt will still show up in your audit logs which looks to be what you're seeing.

Let me know if that answers your question!

3