Have a bit of a people issue and one user who has admin has changed another's privileges from admin to standard. This is a university setting, but the student association not the university's network; I am the parent of the user who was (temporarily) demoted; some experience as a user but not admin using Linux and Apple systems (as well as Windows)...

The root user did not do it and privileges have been restored; current root user is not experienced as a sysadmin though. Does OS X keep log files which would show who made this change? assuming so, which log file(s) would need to be examined to get this information (I take it one needs to look at the asl logs through Console - but which logs?) I do not have access to the system and need to describe this to those who will do it...

Any help would be appreciated.

  • How many admins do you have on that Mac – Ruskes Jun 4 '15 at 18:05
  • Haven't been told - guessing likely all members of the executive of the student association - that would be about 10... – Greenman Jun 4 '15 at 21:37
  • I misunderstood you, normally one would look up under Users&Groups to see who has admin access. – Ruskes Jun 4 '15 at 21:48
  • Turns out only 4 have admin - yes what is needed is to show who changed privileges... I do not have access to the machine (at their association offices) – Greenman Jun 4 '15 at 22:20
  • So - asl and system logs are with me - unfortunately looks like relevant asl logs had rolled over as the event was around the start of this month - but see some interesting things from the oldest system log archive - activity involving the account of the person affected at a time he was not present and not logged in, and clear indications of one other logged in at that time (this person is reputed to keep himself logged in at all times to the extent possible)... and he was active before and after... – Greenman Jun 10 '15 at 16:55

You may also be able to glean some info from the BSM audit logs. The log files are in /var/audit and are viewed with praudit(8). I don't know the format of the audit record for changing an account, but there should be some clues. You can check the date range and look for privilege escalations. The text section may have mentions of the '/Local/Default' node.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .