How To Check The User Creation Date And Time On Windows And Linux

By | October 22, 2009

How To Check The User Creation Date And Time On Windows And Linux

Finding user creation date on the Operating system is a key fact on security audit. This help us to ensure the validity of the user.


On Windows Operating System user creation date are analyised by checking Event viewers, Profiles creation date and net command.

1. Check on Event viewer. It would be good to enable the audit logs.

2. Profile creation date, help us to know the first login date.

002

*If the user have never login into the Operating System. System will not create a new profile folder.

3. Check the user status using net command.

Run -> cm -> net user nameofuser

001


On Linux Operating System user creation date are analyised by checking home directory creation, messages and auditlog.

1. Check the creation data of user home directory

# ls -ld /home/melbin/

Output

drwx—— 5 melbin melbin 4096 Aug 28 22:07 /home/melbin/

2. Grep messages logs.

cat /var/log/messages | grep melbin cat /var/log/messages.* | grep melbin

3. If system auditd are enabled. Search the logs using grep, aureport, ausearch commands. Daemon auditd collects audit subsystem logs and log them on /var/log/audit/audit.log. SELinux uses the audit subsystem.

* aureport –auth | grep melbin

* ausearch

These are two programs, ausearch and aureport, that provide retrieval capabilities. Ausearch is a grep program in that it can be given certain parameters and it will display any records that match. The aureport program was designed to aid in doing reports via awk, perl, or grep. It can select different kinds of information in the audit logs and present them in either columnar form or rankings. Some of the information it can select includes: logins, users, terminals, host names, executables, file access, avc objects, syscalls, watches, or event types.


cat /var/log/audit/audit.log | grep melbin cat /var/log/audit/audit.* | grep melbin

Cheers!
Melbin Mathew
www.talk2melbin.com

Melbin Mathew

I am Melbin Mathew, Systems Engineer from Kerala, India. I live with my parents, daughter and my wonderful wife. I graduated in 2004 with a bachelor’s degree in Electronics and Hardware from Mahatma Gandhi University, Kottayam and completed certification in MCITP, RHCE, CCNA, VCP ...Read More
Category: Linux Windows

About Melbin Mathew

I am Melbin Mathew, Systems Engineer from Kerala, India. I live with my parents, daughter and my wonderful wife. I graduated in 2004 with a bachelor’s degree in Electronics and Hardware from Mahatma Gandhi University, Kottayam and completed certification in MCITP, RHCE, CCNA, VCP ...Read More