Support intro
Sorry to hear you’re facing problems 
help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.
In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:
example
Or for longer, use three backticks above and below the code snippet:
longer
example
here
Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can 
Nextcloud version (eg, 18.0.2):
Operating system and version (eg, Ubuntu 20.04):
Apache or nginx version (eg, Apache 2.4.25):
PHP version (eg, 7.1):
The issue you are facing: when the admin user (or anyone who has the permission: Group admin for ) changes the user to disabled, the user is disabled, but I cannot find a record of that action. Since more people could have the permission to administer users, it makes sense to at least have an audit record of that action. The logging shows the failed logon attempt but that is all you can find, it seems.
Is this the first time you’ve seen this error? (Y):
Steps to replicate it:
- logon as admin
- disable a user
The output of your Nextcloud log in Admin > Logging:
Login failed: <username> disabled (Remote IP: <IP>)
The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):
not relevant to this issue
The output of your Apache/nginx/system log in /var/log/____:
not relevant to this issue