I'll formulate this question that's been nagging me for a long time as best as I can.

OK, so...I'd like to know when was the last time the Mac was last used, meaning: what's the last time the mac was both logged in and the screen unlocked. Thanks to AskDifferent, I managed to painfully get the last time the screen was locked, but this is tricky because the commands to look for change with each version of macOS, even with each incremental update.

So, I'm pretty sure that there has to be a log that can be easily searched for activity that is took place while the mac was both logged in and the screen unlocked. So, any of that activity will tell me a very good approximation of the last usage of the machine.

The reason why I need this is basically that I work as a technician and we need to provide this information to some of our customers...

Also: I know how to get the last log-ins, last apps opened, etc, but this isn't good enough, as they may have been opened for days, even weeks.

Any help will be much appreciated. Thank you.

  • 1
    Just to clarify the question, given know how to get last log-in, do you really want to know the last user activity? Commented Aug 19, 2018 at 9:51
  • Define activity beyond log-ins and apps opened.
    – Allan
    Commented Aug 19, 2018 at 10:43
  • well, as I said in the post, when we receive the macs I notice the last log-ins took place weeks ago as the machine was just going to asleep and never logging out. I got one this week that the last log-in was 93 days ago as the screen was cracked and was left unused so the battery drained and got into hibernation and resumed to its previous state. That's the problem. Allan: a machine may have been logged in last time and the user may have not opened any app, just save files to an external drive for example, or an app may have been used and never closed. Commented Aug 19, 2018 at 11:40
  • Defining "last usage" is subjective, it depends on the damage on the mac, what I need is the last time the machine was logged in and the screen unlocked. For example, the screen is cracked and the user usually won't have an external monitor, so the customer may boot the mac but not log into the machine, that last boot woudn't count as usage Commented Aug 19, 2018 at 11:46
  • basically, any activity that took place while being logged in and screen unlocked would be OK (its timestamp). I guess this isn't that difficult for anyone who knows the macOS logs, which I still don't. Any help would be much appreciated Commented Aug 19, 2018 at 11:51


You must log in to answer this question.

Browse other questions tagged .