So here's a interesting one. We have a Active Directory domain user that appears in the

logged_in_users

table on Ubuntu 1609, but they don't appear in the

users

table, which we're joining against to get the shell history. Any ideas why this might be the case?