Pull OSX User Unlock Times

If you need to pull OSX (Macbook) user unlock timestamps run the following command as root (or with sudo):

mkdir -p /var/admin
usr/bin/log show --last "7d" --predicate 'eventMessage contains "LWDefaultScreenLockUI" and (eventMessage contains "authSuccess" or eventMessage contains "showScreenlock")' > /var/admin/7d.log

The resulting log file looks like this:

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.