Determining account creation date

[roose]

Hi Folks,

Beside from the security audit file, is there a way to determine when an account has been created? Is there a freeware tool that can do this? I am using SCANUAF to determine inactive accounts for more than 90 days, but it does not provide filter like excluding accounts that were created in the past 90 days.

Thanks.

[John Gillings]

Roose,

I think the security audit journal is the only place this information is logged (and then only if you audit UAF changes). You could store the creation date in the user data field in the UAF record itsef, but that won't help retrospective checks.

[Jan van den Ende]

Roose,

I deduce the account creation date from the creation date of the default directory of the account.
Of course, that depends on the (nearly) simultaniousness of account- and directory creation, which in our case happens to be the case.

YMMV

Proost.

Have one on me.

jpe

[Dean McGorrill]

usually people have scripts to create accounts, so as jpe said the creation date
of the account default directory is (probably) accurate.

[roose]

Thanks guys for your response! Well, currently, the practice of using the account's login directory creation date is what we're using as well. I was thinking that there might just be some way of using the UAF record to get when an identifier(?) has been added, or something.

Again, thank you!

[Robert Atkinson]

Roose, if you have Audits switch on for ACL :-

ALPHA_ROB$ show audit
.....
System security audits currently enabled for:
Authorization
....


then you should be able to run an audit report that will show you this type of information :-

anal/audit/event=sysuaf/select=subtype=sysuaf_add
21-MAY-2007 13:19:54.61 SYSUAF SYSUAF_ADD BETA UAFMAN 206029F3 TNA486:
21-MAY-2007 15:13:55.45 SYSUAF SYSUAF_ADD BETA UAFMAN 20603257 TNA616:


Rob.

[Robert Gezelter]

Roose,

A cautionary note: If directories (or disk volumes) have been restored, then the creation date on the directory is not necessarily a reliable indicator of the accounts creation date.

- Bob Gezelter, http://www.rlgsc.com