In reply to Ronny.

Hi Ronny, yes, there is a way to see who created a user or a group. You can find user activity in SAS metadata log (e.g. location SAS/Config/Lev1/SASMeta/MetadataServer/Logs/SASMeta_MetadataServer_2021-09-28_MACHINEID_XXXX.log). For example, I just created a new Group called AAA, then looked in the metadata log and found the following records:

2021-09-28T09:24:55,584 INFO [02142337] 68313:USERID@DOMAIN - Audit Public Object Type=User group Name=AAA ObjId=A50W7ZWR.A500001L has been added.
2021-09-28T09:24:55,584 INFO [02142337] 68313:USERID@DOMAIN - Added IdentityType=IdentityGroup Name=AAA, ObjId=A50W7ZWR.A500001L.

USERID@DOMAIN indicates who created group AAA.
Hope this helps.