I find one attribute -"Create Time" which is a present in the CI. Is there something which we can do with this one to generate a report on knowing when a new user account has been created on the machine?
As you probably know, searching for the user creation time isn't trivial on xNIX systems.
There are some of methods (all of them not complitely working):
- /var/log/wtmp will have login records (we can't assure first login will remain same as account created date )
- passwd -S prints (the date in the output is the date the password was last changed)
- created date of .bash_profile file of the user (we got the desired date, if the file was not modified or edited by user)
- inotify-tools (With that tool you can monitor many events on a given point of your filesystem (i.e. /home) like creation of files/dirs for example. Of course, this will only work if you system is configured to create the home dir at the same time that the account is created).
Bottom line, it's complicated and couldn't bring simple answer.
You could use Create Time on User CI, but this will show when the User ws discovered for the first time. So, the correctness will depends on frequency of the discovery.
Hope this helps.
Regards -Dmitry Gomel, PMP If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution. Click the Like button at the bottom to say 'Thanks'.