Pull OSX User Unlock Times

August 7, 2020

If you need to pull OSX (Macbook) user unlock timestamps run the following command as root (or with sudo):

mkdir -p /var/admin
usr/bin/log show --last "7d" --predicate 'eventMessage contains "LWDefaultScreenLockUI" and (eventMessage contains "authSuccess" or eventMessage contains "showScreenlock")' > /var/admin/7d.log