0

I am trying to give a command to a friend who has been having account passwords changed. He is trying to determine a way to figure out when the password was last changed. I was able to give him this command, that is working in MacOS terminal, but I want to make it a bit nicer by providing a readable answer. Here is the command:

dscl . read /Users/username accountPolicyData | grep -A1 SetTime

which results in something like this:

    <key>passwordLastSetTime</key> 
    <real>1670348364.4110398</real>

This command is pulling the reset date and time great, but him having to search out an epoch time calculator may be a bit over his head. My question:

Do any of you have any idea how I could strip out the bracketed text and convert the epoch time from the commandline? I'm happy to drop the title line if that helps if doing so would allow a numerical conversion that is readable.

Thanks for any suggestion you may have.

Josh
  • 113
  • 1
  • 5

2 Answers2

1

You can use defaults to read plist :

#!/bin/bash

file=$(mktemp /tmp/XXXXXXXX.plist)
dscl . read /Users/username accountPolicyData | tail -n +2 > $file 
c=$(defaults read $file passwordLastSetTime)
date -r ${c%.*} '+%Y-%m-%d %H:%M:%S'
rm $file
Philippe
  • 20,025
  • 2
  • 23
  • 32
0

You can use the following command to extract the epoch time and convert it to a human-readable date and time:

dscl . read /Users/username accountPolicyData | grep -A1 passwordLastSetTime | awk '/real/ {print strftime("%c",$2)}'

Explanation:

  • dscl . read /Users/username accountPolicyData is the same as before, it retrieves the account policy data for the specified username.

  • grep -A1 passwordLastSetTime filters the output to show only the line containing passwordLastSetTime and the next line.

  • awk '/real/ {print strftime("%c",$2)}' is an awk script that processes the filtered output. The script matches the line that contains real, extracts the second field ($2), and converts it from an epoch time to a human-readable date and time using the strftime function. The %c format string for strftime specifies a locale-specific date and time format.

Tyler2P
  • 2,324
  • 26
  • 22
  • 31
Eman S
  • 9
  • That awk command requires GNU awk, it won't work with the BSD awk that comes with MacOS. You never need grep when you're using awk - that `grep | awk` pipeline is equivalent to `awk 'f{if (/real/) print ...; f=0} /passwordLastSetTime/{f=1}` but could probably be reduced to just `awk 'f{print ...; f=0} /passwordLastSetTime/{f=1}` – Ed Morton Feb 06 '23 at 22:12
  • You'd also need to add `-F '>'` to separate the time into `$2`. – Ed Morton Feb 06 '23 at 22:18