account_policy_data

Additional macOS user account data from the AccountPolicy section of OpenDirectory.

Example

Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.

SELECT strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationdate FROM account_policy_data;

See each user's last password set date and number of failed logins since last successful login to detect any intrusion attempts.

SELECT u.username u.uid, strftime('%Y-%m-%dT%H:%M:%S', a.password_last_set_time, 'unixepoch') AS password_last_set_time, a.failed_login_count, strftime('%Y-%m-%dT%H:%M:%S', a.failed_login_timestamp, 'unixepoch') AS failed_login_timestamp FROM account_policy_data AS a CROSS JOIN users AS u USING (uid) ORDER BY password_last_set_time ASC;