Troubleshooting
Query the cmn_sec_users table to see when the user was updated and by who.
Look for jobs/processes run during that time.
Query to check scripts that update the cmn_sec_users table in order to identify if a process GELS cript is doing the updates:
SELECT
bdp.process_code,
bdsa.action_code,
bds.step_code,
ccs.script_text
FROM
bpm_def_step_actions bdsa
JOIN bpm_def_steps bds ON bds.id = bdsa.step_id
JOIN bpm_def_stages bdst ON bdst.id = bds.stage_id
JOIN bpm_def_process_versions bdpv ON bdpv.id = bdst.process_version_id
JOIN bpm_def_processes bdp ON bdp.id = bdpv.process_id
JOIN cmn_custom_scripts ccs ON ccs.id = bdsa.script_id where lower(script_text) like '%update cmn_sec_users%'