Posted on 07-21-2016 12:52 PM
Does anyone know if there is a log or way to view who granted admin rights to a user on a MAC ?
In Windows, our security office has a way to report on this and wants to know if there is a way to do it on a Mac. I have yet to find it or even know if it is possible.
Posted on 07-22-2016 12:57 PM
From the looks of it, the file responsible for this is /var/log/authd.log
Running a test I entered system preferences and access an admin required location and it recorded in that said file as my username being granted.
Posted on 07-26-2016 10:00 AM
Thank you for the response, I see where it shows the unlock but doesn't log who was granted admin rights.
I am going to try opening a ticket with Apple to see if it can be done. Thanks again
Posted on 07-26-2016 10:08 AM
There's also some information logged in /var/log/system.log. You could match the date/time of the system log entry to the details in the authd.log to get the complete information.