Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I determine the last time an Open Directory network account was used? I am completing a user/group audit and am looking to identify users that have not used their network account recently.

share|improve this question
up vote 1 down vote accepted

According the wikipedia doc Open Directory is an implementation of LDAP, also that the Open Directory stores the User data in a file which can be directly inspected, so there are a couple of options.

This post here indicates that the following command can be used to show the last updated time which is updated on login (unfortunately this value is also incremented by password changes, so is not necessarily accurate, but can give a lower bound)

 mkpassdb -dump | grep username

I didn't find the open Directory user "account" object schema, but you might find it useful to download jxplorer or some LDAP client tool and directly inspect the account entries for something like a "LastLogin" field. There are a whole bunch of docs on the Open Directory product on the apple site here, which might help you in search for the correct LastLogin attribute to use in an ldapsearch query.

There is this excerpt from a google books search which might also be helpful if you have no luck with the above;enter link description here

So worstest of cases, is that you look in this file here for the last Login time; enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.