Return
-
Title
How to check when a password was last set from the command line. -
Description
There could be an issue where you are troubleshooting an account that appears to be getting locked out. In this case it was a service account that was using a hard coded password for mounts. The password was not expected to change however someone had changed it. Checking the attributes on the account revealed this. -
Resolution
The following will dump all the attributes for an account:
# /opt/quest/bin/vastool -u host/ attrs <username>Add a tee to dump it to a file:
# /opt/quest/bin/vastool -u host/ attrs <username> 2>&1 | tee /tmp/attrs.out
The following will show when the password was last set.
# /opt/quest/bin/vastool -u host/ attrs <username> | grep pwdLastSet
And if it's locked out:
# /opt/quest/bin/vastool -u host/ attrs <username> | grep lockoutTime
Note that the output will be a 18-digit Active Directory timestamp. There are many online sites that provide the ability to convert this to a "human readable" date. Search on something similar to "LDAP, Active Directory, Filetime Timestamp Converter".