Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Determining account creation date

 
roose
Regular Advisor

Determining account creation date

Hi Folks,

Beside from the security audit file, is there a way to determine when an account has been created? Is there a freeware tool that can do this? I am using SCANUAF to determine inactive accounts for more than 90 days, but it does not provide filter like excluding accounts that were created in the past 90 days.

Thanks.
6 REPLIES
John Gillings
Honored Contributor

Re: Determining account creation date

Roose,

I think the security audit journal is the only place this information is logged (and then only if you audit UAF changes). You could store the creation date in the user data field in the UAF record itsef, but that won't help retrospective checks.
A crucible of informative mistakes
Jan van den Ende
Honored Contributor

Re: Determining account creation date

Roose,

I deduce the account creation date from the creation date of the default directory of the account.
Of course, that depends on the (nearly) simultaniousness of account- and directory creation, which in our case happens to be the case.

YMMV

Proost.

Have one on me.

jpe
Don't rust yours pelled jacker to fine doll missed aches.
Dean McGorrill
Valued Contributor

Re: Determining account creation date

usually people have scripts to create accounts, so as jpe said the creation date
of the account default directory is (probably) accurate.
roose
Regular Advisor

Re: Determining account creation date

Thanks guys for your response! Well, currently, the practice of using the account's login directory creation date is what we're using as well. I was thinking that there might just be some way of using the UAF record to get when an identifier(?) has been added, or something.

Again, thank you!
Robert Atkinson
Respected Contributor

Re: Determining account creation date

Roose, if you have Audits switch on for ACL :-

ALPHA_ROB$ show audit
.....
System security audits currently enabled for:
Authorization
....


then you should be able to run an audit report that will show you this type of information :-

anal/audit/event=sysuaf/select=subtype=sysuaf_add
21-MAY-2007 13:19:54.61 SYSUAF SYSUAF_ADD BETA UAFMAN 206029F3 TNA486:
21-MAY-2007 15:13:55.45 SYSUAF SYSUAF_ADD BETA UAFMAN 20603257 TNA616:


Rob.
Robert Gezelter
Honored Contributor

Re: Determining account creation date

Roose,

A cautionary note: If directories (or disk volumes) have been restored, then the creation date on the directory is not necessarily a reliable indicator of the accounts creation date.

- Bob Gezelter, http://www.rlgsc.com