Need help tracking down something changing a field

[Kai Tingey]

Hi All

Every morning at 6:30~am *something* is changing all our user records email addresses to lower case.

I can't find what is causing it.

The full LDAP import runs at 01:45 (you can see that in the log above), and that is setting the email correctly. Then at 06:30 or so, something else comes along and changes it to all lower case. 

There are no scheduled jobs running at that time, no workflows, no flow executions. Nada. The audit log isn't telling me much.

Has anyone got any ideas how i can track down what's doing this? It's not really hurting anything but it is pretty annoying now that i know that it's there.

[Ankur Bawiskar]

@Kai Tingey 

if it's updating lot of users around same time then definitely some automation is doing that

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Kai Tingey]

thanks for the responses guys, it's definitely something scheduled but there are no scheduled jobs, flows or workflows running at that time that look they would do this.

a few scheduled jobs that create maintenance tasks, some reports and an oob flow called 'send_notifications' (Generate Now Assist Troubleshooting Notifications). I've poked into all of them and none of them are messing with the sys user table.

not sure where else to look ¯\_(ツ)_/¯

[Ankur Bawiskar]

@Kai Tingey 

did you check sys_trigger?