Skip to main content
Question

Admin Rights System Logging

  • July 21, 2016
  • 3 replies
  • 20 views

jconte
Forum|alt.badge.img+12

Does anyone know if there is a log or way to view who granted admin rights to a user on a MAC ?
In Windows, our security office has a way to report on this and wants to know if there is a way to do it on a Mac. I have yet to find it or even know if it is possible.

Thanks
Jeff

3 replies

Forum|alt.badge.img+7
  • Contributor
  • July 22, 2016

From the looks of it, the file responsible for this is /var/log/authd.log

Running a test I entered system preferences and access an admin required location and it recorded in that said file as my username being granted.


jconte
Forum|alt.badge.img+12
  • Author
  • Valued Contributor
  • July 26, 2016

Thank you for the response, I see where it shows the unlock but doesn't log who was granted admin rights.
I am going to try opening a ticket with Apple to see if it can be done. Thanks again


davidacland
Forum|alt.badge.img+18
  • Valued Contributor
  • July 26, 2016

There's also some information logged in /var/log/system.log. You could match the date/time of the system log entry to the details in the authd.log to get the complete information.