Hi, I need to know if there's a way to see who installed an app on MacOS. We run High Sierra in our labs and we've had an incident where a couple unauthorized apps were installed. Any information is greatly appreciated!
iMac, macOS High Sierra (10.13.6)
From admin you would have access to log into each user accounts— from that users terminal app copy and paste:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'
This will show you all downloads for that user account
If you had been running System Accounting accton(8)during the timeframe of the event you want to isolate, then you could produce a report of all commands run by an individual user through the sa(8)utility. You could also do this with lastcomm(1) provided that the original accounting file remained from the timeframe where you want to isolate the user and particular command.
Do all users have their own account? You can find the date & time they were installed in "About This Mac" > System Report > Software > Installations.
If it is a "drag and drop" app, the user that installed it will likely be the "owner" of the app. It's not always true, though.
All users have their own accounts. I know about "System Information." I forgot to add it to my question. I had it in my first post attempt but it messed up and I had to redo it X_x Would the date and time lead me to who installed it because that's what I need.
Thanks
Wait. How does an admin have access to log into another user's account? Also, does this extend to network accounts too (note: we don't have mobile accounts enabled so there are no users listed in the login outside of the admin one)?
Leroy and atridgell, have similar on our network, lurkers that appear when browsing history is cleared and then website data is removed. Can't find any apps installed, but disappear for a while, on macOS reinstall. Must be somewhere. Hack hangs two sites on us: cullturesforhealth.com and encycolorpedia.com (italian homestyle cooking and korean clothes). Stack-over site visit instant infection [1800's aussie boaters, typical].
Here's a site with more
sqliteYour Mac Remembers Everything You Download. Here's How to Clear Download History. - The Mac Observer
View dl:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'select LSQuarantineDataURLString from LSQuarantineEvent'Clear dl:
sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'Auto clearing:
do shell script "sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV* 'delete from LSQuarantineEvent'"Well the date & time would help if you knew which user was on when. There may be a way to use Console but I don't know how. Hopefully someone else will respond.
This could work. I'll have a load of users to go through for this since it happened towards the end of last school year. It may be a bit before I get to check it out though.
Good luck.
If you type "last" (without quotes) into the Terminal, it will list when users logged in. Then you can match up the install time. Of course someone could have done it while a different user was still logged in and away from the Mac.
Find User Who Installed App