The Full User Audit analyzes users in bounded batches and classifies their risk level.
The audit is informational only. Running it does not delete or modify user accounts.
Audit summary
The summary shows:
- status;
- total users at start;
- users analyzed;
- protected users;
- analyzable users;
- progress;
- start time;
- latest update;
- completion time.
When an audit is complete, you can reset it and run a new audit if the user population has changed.
Risk ranges
Astricode Ops groups analyzable users into ranges:
- 0–19 — Very low risk
- 20–39 — Low risk
- 40–59 — Medium risk
- 60–79 — High risk
- 80 or higher — Current candidate
The audit view shows the count and percentage of analyzable users in each range.
Reasons behind the score
The interface can summarize frequent reasons associated with user scores, such as:
- incomplete profiles;
- structurally suspicious logins;
- display names identical to suspicious logins;
- promotional vocabulary in usernames;
- numeric-only usernames;
- suspicious email-domain suffixes;
- unusual character patterns.
A score is built from evidence. Review the reasons before taking destructive action.
Frequent email domains
The audit can also show domains that occur frequently in the analyzed population.
A domain appearing frequently is not automatically malicious. The domain table is intended to help administrators identify patterns.
Protected users
Protected accounts are reported separately and excluded from analyzable totals where appropriate.
Use manual protection for known legitimate accounts that could otherwise resemble suspicious patterns.
Recommended interpretation
Do not treat one signal as definitive. A numeric username on its own can be legitimate. A stronger cleanup candidate usually combines several risk indicators and lacks evidence of legitimate activity.