Look up last user via Mac OS Server

[dennitzio]

I have a couple of Macs which have disappeared from my network and may have been "borrowed" by a teacher or student. I'm trying to track down the last user login. I have the computers using El Capitan with Profile Manager and Open Directory. All accounts are set up as Mobile (no syncing) so they have to log in the first time on network but can log in off network.

 

I can tell when they were last on the network (using Unifi), which matches with the Profile Manager log's last known push. But the PM log doesn't seem to show user and if there's a way to look in the OD or LDAP logs I can't figure it out. Any help welcome!

 

I have all computers on iCloud, but one of them has strangely dropped off and isn't showing in my list of devices. The other one shows as offline (I've ticked the alert me when it shows up box).

 

Thanks,

Den

[AntonioRocco]

If the users are in your Active Directory database you won't find this out via Profile Manager/OD which means using the Server.App is of no real use to you. 'Best' place to look is locally on the macs themselves (which you don't have) but if you did or if you've enabled SSH or Remote Management you can issue "last" (without the quotes) from the command line which will give you the login history for that device.

[dennitzio]

Thank you! That is what I assumed but I appreciate you replying and letting me know. If you have any other ideas please let me know!

[mrnoisy]

Which AV do you use, I've used Sophos in the past to see when the devices last checked in for updates and by who, might be worth a shot, depends which AV your using.

[asanders]

We use an inventory auditing software called OCS-NG. Its free and does a fairly good job for inventorying machines. When it inventories it will grab the current logged in user. You could force a scan at login. The other option would be to setup a webserver and when ever a user logins or logouts it issues a curl command with the username and machine. At a previous job we did something similar by outputting to a csv on a fileshare.

[dennitzio]

Thank you both for the suggestions!