How can I determine the last time an Open Directory network account was used? I am completing a user/group audit and am looking to identify users that have not used their network account recently.
This post here indicates that the following command can be used to show the last updated time which is updated on login (unfortunately this value is also incremented by password changes, so is not necessarily accurate, but can give a lower bound)
I didn't find the open Directory user "account" object schema, but you might find it useful to download jxplorer or some LDAP client tool and directly inspect the account entries for something like a "LastLogin" field. There are a whole bunch of docs on the Open Directory product on the apple site here, which might help you in search for the correct LastLogin attribute to use in an ldapsearch query.
There is this excerpt from a google books search which might also be helpful if you have no luck with the above;enter link description here
So worstest of cases, is that you look in this file here for the last Login time;