Microsoft Dynamics 365 | Integration, Dataverse...

Finding the cause for a Ghost Mass Edit

(0) Share

Report

Posted on by Johnny Aaron

My customer has a bunch of solutions and workflows, and we are trying to find out how a bunch of records were edited, and are not able to find why. They are records in a custom entity that have been switched to Inactive all at once, during a few different events. Almost all of the workflows do not have tracing enabled for capacity reasons. No plugins fring that I can see.

I am looking for just advice on how to find the cause. Any best practices on diagnosing how an edit could have happened? I have checked all of the below so far:

Processes in Dependencies
Searched for other workflows
- Searched keywords Deactivate, cancelled, update, status
Deactivated Users
Looked at Audit logs of the record and related records (no edits around the same time)
Field Mapping
Cascade Rules
Business Rules
Pulled other examples and looked for patterns

All responses (4)

Answers (0)

Johnny Aaron 5 on at

Like (0)

Report

RE: Finding the cause for a Ghost Mass Edit

Hello @Charles Abi Khirs, thanks for your reply! Answers to your more questions in line below, let me know if you think I can narrow it down any further.

1. What D365 version are uou using? Online 9.2.21055.00137. Dynamics 365 CE Online.

2. What is the recurrence of this update? 128 on May 25th, 716 records were deactivated on May 13th, and 84 on Jun 10th. I haven't been able to identify a pattern yet. Perhaps something else is triggering it, or someone was doing something manually before.

4. Does this update is applied to all records? Or specific ones? Just one entity, for specific records, no pattern I can find as to which records vs others.

3. What data are being updated? Or it is only being desactivated? Just being deactivated.

5. Is there any process/batch that is being executed and do the update? I don't know. I can't find one that would, and there are no system jobs that say so, however most of the workflows are deleting system jobs after they succeed.

6. Do you have a power automate that might be scheduled to run and do the update? Nope.
Suggested answer

Charles Abi Khirs 3,569 on at

Like (0)

Report

RE: Finding the cause for a Ghost Mass Edit

Hello,

1. What D365 version are uou using?

2. What is the recurrence of this update?

3. What data are being updated? Or it is only being desactivated?

4. Does this update is applied to all records? Or specific ones?

5. Is there any process/batch that is being executed and do the update?

6. Do you have a power automate that might be scheduled to run and do the update?
Johnny Aaron 5 on at

Like (0)

Report

RE: Finding the cause for a Ghost Mass Edit

Thanks for replying. Discussing with the client on making the Support Ticket, will probably go that route. I suppose just doing some due diligence before sending their way.

As far as malicious, unknown. A user just noticed it, and it just deactivated one of their records, which they quickly re-activated, but may have missed because of views/reporting. No clear sign as of yet of any external party having an incentive to do this intentionally or maliciously.
AriaConsulting 2 on at

Like (1)

Report
RE: Finding the cause for a Ghost Mass Edit

So, a couple of questions:

Does the nature of the edits cause some form of business harm to your customer? In other words, does it appear to be malicious?

Have you contacted MS support? They have tools that aren't available to us as partners (obviously) that can provide trace logs and the like.