|
No, but all users are created by the super user (root or, possibly, sudo; who had root or sudo permissions a year or so ago?
As to narrowing down when, you could go to your back up archive and look at /etc/passwd for the userid; when it's not there you found the before date. Then you can go to the next back up and get a close idea of the date (but, alas, not "who" specifically). If you don't have weekly back up's, well, that's that.
Hope this helps some.
|
