Here's how you can do it:
Using SE16, get the records from AGR_USERS table with field COL_FLAG=' '
Relate this to USR02 table BNAME field to decide if the user account is locked (valid) or not in use anymore.
I've also discovered this can be done in transaction S_BCE_68001394 (Users by User ID). You just input * into the user ID field, execute the report and then sort the two columns for "Direct Assignment" and "Role Type". This will give you the Single roles assigned directly.