Can I script checking for password date changes from ARD? Basically, I would like to know if the root password as been changed on several machines. Can I have Apple Remote Desktop script this for me and automate this check?
I found the info, but the data format is unnecessarily complex. At least in Mavericks (and I suspect several previous versions), it's in a property list, which is wrapped up inside another property list (the passwordpolicyoptions property in /var/db/dslocal/nodes/Default/users/root.plist). Theoretically, you should extract that property to a file, then use something like /usr/libexec/PlistBuddy to get the passwordLastSetTime property from it... but hacking it with sed is much easier:

dscl . -read /Users/root PasswordPolicyOptions | sed -n '/passwordLastSetTime/{n;s@.*&lt;date&gt;\(.*\)&lt;/date&gt;@\1@p;}'


This command must be run as root; interactively you'd use sudo, but if you're running it with ARD, just use "Send UNIX Command", and set "Run command as: User: root".