What would cause zSecure to re-issue previously scheduled actions? I have had at least 3 cases of this happening. We use scheduled cancel commands to essentially "hard revoke" user IDs so only we can reinstate them. Recently, I have seen old scheduled actions on Ids that are in use. Some examples are below:
This was on an ID on Saturday 11/15 that has been in use daily for years and I cannot find any where that the command was issues to cancel.
User: XXXXXXX Name: XXXXXX Last Init: 15Nov2025
Hard revokes:
CANCEL REVOKE by $SECURTY at 14Jun2021 01:29
This one was on a security team members ID a week or so ago which again is used multiple times daily. The User ID had the scheduled event issued on it in 2023 and then removed the same day.
Scheduled event: Schedule 'CANCEL' disable 28 Apr 2023; set by xxxxxx at 28
--- Overall revoke/resume status ---
Revoked from 28 Apr 2023
Current audit trail shows this:
REVOKE Removed on 23.118/14:42 by xxxxxxx
RESUME Added on 23.118/15:39 by xxxxxxx