What log file would show when a Mac OSX user was renamed?

June 4, 2009 6:01 PM

on Mac OSX Leopard(10.5.7), which log file, archived or not, would I find when a user account was renamed?

Easy as that. A user account on a machine was renamed. I'd like to find out when. I'm currently logged in as the admin but do not have the admin password.

posted by neilkod to computers & internet (6 comments total)

Could you back up Time Machine, change a user account, and then use Time Machine to see what changed?
posted by interrobang at 6:10 PM on June 4

Do you mean the short (unix) name? There's no UI for that, and it's a non-trivial operation, changing it, with multiple steps. It's not going to be logged. It'd pretty much involve using the terminal to do competently -- anyone competent enough could easily enough cover their tracks.

If this isn't a cover-yr-tracks situation, there's a good chance the relevant commands will be in the ~/.bash_history file, but that isn't time-stamped, so unless they're the most recent (and hence you can find out when it was changed from its info) commands, you're not going to get much closer.

Can you give any more information? There may be another way to achieve your ultimate goal -- why is it you want to know when the account was changed?
posted by fightorflight at 6:22 PM on June 4

fightorflight, according to good-ol whoami, the unix name remained the same. the display name changed. sorry, I should have been more descriptive. I need to know when the short name was changed. The why isn't as important as the how (or we could mefi mail).
posted by neilkod at 6:28 PM on June 4

Ah, if it's the long name that's changed, there are a couple of ways to tell. Two spring to mind.

The first is in terminal, but you'll need the admin password. then type
sudo ls -l /private/var/db/dslocal/nodes/Default/users, type the admin password and then
and look at the date beside [usershortname].plist. That's the last time the user's account was updated.

The second, less reliable, way is to open Console (in Applications/Utilities), then navigate to LOG FILES, /var/log and click on secure.log. In the Filter search box in the toolbar, type coreservicesd. This is activated when someone authorises the Accounts panel in System Preferences, which is the most likely way it was changed. You might have to step back through the previous versions of the log to spot it -- they're called secure.log.x.bz2 in the list.

(NB: this is all assuming a one-machine setup. If these are network accounts neither method will work).
posted by fightorflight at 6:46 PM on June 4

fightorflight, there is a GUI for changing the short name. Right-click on an account (after unlocking the Accounts pref pane) and choose Advanced Options. One of the handful of things you can do is change the account shortname.
posted by pmbuko at 7:41 PM on June 4

Sorry, yes, I should have been clearer: you can change the short name there, but in the majority of cases it'll just break the account -- I meant that there's no UI to change it in a one-step way, if you follow me.

There's a few other things you have to do to make it really stick -- at the very least you'll need to shift the account folder as superuser, and that'd show up in the terminal history (again assuming that this isn't somewhere that tracks will be covered)
posted by fightorflight at 8:23 PM on June 4