The report didn't show the last IP address, beacuse the actions were runned by CLI. With Holden's tip, I checked the enrolment instances in MEV152 course and they have an expiration date set to 30 weeks.
I belive that this was the problem! I'll compare others logs to confirme, but for me is a racional explain!
I didn't know was possible to cancel enrolment using a expiration date!
Thanks for help, Task and Holden!
General help
User Administrator: actions by CLI showed on log
This discussion has been locked so you can no longer reply to it.