topic Re: Determining account creation date in Operating System - OpenVMS

Determining account creation date

roose — Fri, 01 Jun 2007 02:46:48 GMT

Hi Folks,

Beside from the security audit file, is there a way to determine when an account has been created? Is there a freeware tool that can do this? I am using SCANUAF to determine inactive accounts for more than 90 days, but it does not provide filter like excluding accounts that were created in the past 90 days.

Thanks.

Re: Determining account creation date

John Gillings — Fri, 01 Jun 2007 02:59:13 GMT

Roose,

I think the security audit journal is the only place this information is logged (and then only if you audit UAF changes). You could store the creation date in the user data field in the UAF record itsef, but that won't help retrospective checks.

Re: Determining account creation date

Jan van den Ende — Fri, 01 Jun 2007 05:04:35 GMT

Roose,

I deduce the account creation date from the creation date of the default directory of the account.
Of course, that depends on the (nearly) simultaniousness of account- and directory creation, which in our case happens to be the case.

YMMV

Proost.

Have one on me.

jpe

Re: Determining account creation date

Dean McGorrill — Fri, 01 Jun 2007 11:08:16 GMT

usually people have scripts to create accounts, so as jpe said the creation date
of the account default directory is (probably) accurate.

Re: Determining account creation date

roose — Sun, 03 Jun 2007 21:06:39 GMT

Thanks guys for your response! Well, currently, the practice of using the account's login directory creation date is what we're using as well. I was thinking that there might just be some way of using the UAF record to get when an identifier(?) has been added, or something.

Again, thank you!

Re: Determining account creation date

Robert Atkinson — Mon, 04 Jun 2007 02:59:04 GMT

Roose, if you have Audits switch on for ACL :-

ALPHA_ROB$ show audit
.....
System security audits currently enabled for:
Authorization
....

then you should be able to run an audit report that will show you this type of information :-

anal/audit/event=sysuaf/select=subtype=sysuaf_add
21-MAY-2007 13:19:54.61 SYSUAF SYSUAF_ADD BETA UAFMAN 206029F3 TNA486:
21-MAY-2007 15:13:55.45 SYSUAF SYSUAF_ADD BETA UAFMAN 20603257 TNA616:

Rob.

Re: Determining account creation date

Robert Gezelter — Mon, 04 Jun 2007 05:11:04 GMT

Roose,

A cautionary note: If directories (or disk volumes) have been restored, then the creation date on the directory is not necessarily a reliable indicator of the accounts creation date.

- Bob Gezelter, http://www.rlgsc.com