I am trying to query a user who was disabled last year. IDR shows user as disabled but I am not able to find out the logs for the date the user was disabled.
Within Active Directory Admin Activity if you search
where(username,loose)
It should return all hits for that user, and from there you could add groupby(action)
David