Recently we've had a couple user accounts mysteriously disappear. Is there any way to track these accounts and determine who/how they were deleted?
A few thoughts.
Can only root users delete accounts on you systems?
If not, Are you using sudo to allow no root users to remove accounts?
If only root users are allowed, if the user used smitty to remove the accounts the only place I know that this is logged is in the /smit.log file. If they used rmuser for instance I think you are out of luck other than maybe reviewing the shell history by looking at the .sh_history file but unless you limit the root access with sudo than you probably won't be able to tell what user was logged in a root at the time.
If you can determine what day they were deleted (by looking at old backups or something) then maybe you could review the /var/adm/sulog file to see what users logged into the root account on that day.
If your users are using sudo and you have the logging feature turned on then you should be able to review the sudo logs.
At our side we have a wrapper script wrapped around the rmuser command and we log who uses that script.
Nothing concrete provided here but hopefully the info was helpful.
Yes, that will be helpful. Thanks.