How can I determine the last time an Open Directory network account was used on Mac OS X 10.7 Server?

Question

How can I determine the last time an Open Directory network account was used? I am completing a user/group audit and am looking to identify users that have not used their network account recently.

Answer 1

According the wikipedia doc Open Directory is an implementation of LDAP, also that the Open Directory stores the User data in a file which can be directly inspected, so there are a couple of options.

This post here indicates that the following command can be used to show the last updated time which is updated on login (unfortunately this value is also incremented by password changes, so is not necessarily accurate, but can give a lower bound)

 mkpassdb -dump | grep username

I didn't find the open Directory user "account" object schema, but you might find it useful to download jxplorer or some LDAP client tool and directly inspect the account entries for something like a "LastLogin" field. There are a whole bunch of docs on the Open Directory product on the apple site here, which might help you in search for the correct LastLogin attribute to use in an ldapsearch query.

There is this excerpt from a google books search which might also be helpful if you have no luck with the above;enter link description here

So worstest of cases, is that you look in this file here for the last Login time;

Answer 2

A solution with no root required:

date -j -r $(pwpolicy -u <username> --get-effective-policy | awk 'NR>2' | tr ' ' '\n' | grep 'lastLoginTime' | cut -d '=' -f 2)

This gives the information missing in the Open Directory Workgroup Management GUI.