What log file would show when a Mac OSX user was renamed?
June 4, 2009 6:01 PM Subscribe
on Mac OSX Leopard(10.5.7), which log file, archived or not, would I find when a user account was renamed?
Easy as that. A user account on a machine was renamed. I'd like to find out when. I'm currently logged in as the admin but do not have the admin password.
Easy as that. A user account on a machine was renamed. I'd like to find out when. I'm currently logged in as the admin but do not have the admin password.
Do you mean the short (unix) name? There's no UI for that, and it's a non-trivial operation, changing it, with multiple steps. It's not going to be logged. It'd pretty much involve using the terminal to do competently -- anyone competent enough could easily enough cover their tracks.
If this isn't a cover-yr-tracks situation, there's a good chance the relevant commands will be in the ~/.bash_history file, but that isn't time-stamped, so unless they're the most recent (and hence you can find out when it was changed from its info) commands, you're not going to get much closer.
Can you give any more information? There may be another way to achieve your ultimate goal -- why is it you want to know when the account was changed?
posted by fightorflight at 6:22 PM on June 4, 2009
If this isn't a cover-yr-tracks situation, there's a good chance the relevant commands will be in the ~/.bash_history file, but that isn't time-stamped, so unless they're the most recent (and hence you can find out when it was changed from its info) commands, you're not going to get much closer.
Can you give any more information? There may be another way to achieve your ultimate goal -- why is it you want to know when the account was changed?
posted by fightorflight at 6:22 PM on June 4, 2009
Response by poster: fightorflight, according to good-ol whoami, the unix name remained the same. the display name changed. sorry, I should have been more descriptive. I need to know when the short name was changed. The why isn't as important as the how (or we could mefi mail).
posted by neilkod at 6:28 PM on June 4, 2009
posted by neilkod at 6:28 PM on June 4, 2009
Ah, if it's the long name that's changed, there are a couple of ways to tell. Two spring to mind.
The first is in terminal, but you'll need the admin password. then type
sudo ls -l /private/var/db/dslocal/nodes/Default/users, type the admin password and then
and look at the date beside [usershortname].plist. That's the last time the user's account was updated.
The second, less reliable, way is to open Console (in Applications/Utilities), then navigate to LOG FILES, /var/log and click on secure.log. In the Filter search box in the toolbar, type coreservicesd. This is activated when someone authorises the Accounts panel in System Preferences, which is the most likely way it was changed. You might have to step back through the previous versions of the log to spot it -- they're called secure.log.x.bz2 in the list.
(NB: this is all assuming a one-machine setup. If these are network accounts neither method will work).
posted by fightorflight at 6:46 PM on June 4, 2009
The first is in terminal, but you'll need the admin password. then type
sudo ls -l /private/var/db/dslocal/nodes/Default/users, type the admin password and then
and look at the date beside [usershortname].plist. That's the last time the user's account was updated.
The second, less reliable, way is to open Console (in Applications/Utilities), then navigate to LOG FILES, /var/log and click on secure.log. In the Filter search box in the toolbar, type coreservicesd. This is activated when someone authorises the Accounts panel in System Preferences, which is the most likely way it was changed. You might have to step back through the previous versions of the log to spot it -- they're called secure.log.x.bz2 in the list.
(NB: this is all assuming a one-machine setup. If these are network accounts neither method will work).
posted by fightorflight at 6:46 PM on June 4, 2009
fightorflight, there is a GUI for changing the short name. Right-click on an account (after unlocking the Accounts pref pane) and choose Advanced Options. One of the handful of things you can do is change the account shortname.
posted by pmbuko at 7:41 PM on June 4, 2009
posted by pmbuko at 7:41 PM on June 4, 2009
Sorry, yes, I should have been clearer: you can change the short name there, but in the majority of cases it'll just break the account -- I meant that there's no UI to change it in a one-step way, if you follow me.
There's a few other things you have to do to make it really stick -- at the very least you'll need to shift the account folder as superuser, and that'd show up in the terminal history (again assuming that this isn't somewhere that tracks will be covered)
posted by fightorflight at 8:23 PM on June 4, 2009
There's a few other things you have to do to make it really stick -- at the very least you'll need to shift the account folder as superuser, and that'd show up in the terminal history (again assuming that this isn't somewhere that tracks will be covered)
posted by fightorflight at 8:23 PM on June 4, 2009
« Older UNIVERSAL AC ADAPTERS AINT WHAT THEY USED TO BE (a... | To Grandmother's block we go? Newer »
This thread is closed to new comments.
posted by interrobang at 6:10 PM on June 4, 2009