Active Directory user long gone but still in the logs



We have very weird issue. Sophos is in Active Directory environment.

Now, we have an employe who left over a year ago. His machine was given to new employee but the traffic from that machine is counted as it was the former employee acessing the internet. I mean when i go to Logging & Reporting -> Web Protection -> Users. User does not exist in AD.

We have 5 UTMs in the company and only one is acting up.

How is this happening and how can i fix it?


Kind regards,


  • It's weird. User apears in Logging & Reporting -> Web Protection -> Users but i searcjhed for it in Web filtering logs and no sign of this user.

  • Hi Andrzej,

    I don't remember seeing this problem mentioned here before, so I'll try guessing.  Is the user object for that user still present in WebAdmin?

    Cheers - Bob

  • In reply to BAlfson:

    Yes, it was. The user was created there to test something and then has been disabled.

    Deleted the user. Hope this resolve the issue


    Thank you very much


    Kind regards,