Deleted Users in ERP 10.2.200.12 need to know where to track

Epicor ERP 10
1

We have a situation in Epicor ERP 10.2.200.12 environment whereby user accounts have been deleted and need to know who might have deleted or what could have triggered to delete the user account.

Is there a way to identify from Epicor what could have happened. We have identified the list of users deleted from previous backups and compared with the current backups and pointed to the actual day this event has occurred but still would like to know the root cause.

Any help is appreciated

2

My other major concern is how is Epicor allowing users to be deleted from ERP 10.2.200.12 system that have got transactions and data passed against.

Any user having transactions passed should not be allowed for deletion rather should be allowed to disable only for the sake of history and audit.

Nikhil