I too have learned the value of "turn it off and see who complains" as a last-ditch effort at determining who is still using something and why. It is remarkably effective. However, in at least one case it did take almost an entire week for someone to notice and complain.
This method caused a $10 million dollar, 10 hour long outage at a previous company. You should probably consider who will be complaining in the risk analysis before doing it ;P
There’s honestly no other way to do it. We did this way back when with TLS 1.1 depreciation. We couldn’t use “has anyone connected with TLS 1.1” because all that told us was someone had support for 1.1, not if they could support 1.2. So we turned it off intermittently with increasing frequency to try and generate support tickets.
