Check if user has changed PW
 

Is there any way I can do this? The pw is not set to expire, so I cant just look at the expiration date and trace it back.

Rich

You could create a script called:
changepw

or similar that calls:
passwd

Then if it exits with "0" then you can:
echo -n user USERNAME changed their password >> /etc/passcheck
date >> /etc/passcheck

thanks...but I need to check if someone ALREADY changed their PW...eeks..

Look at field 3 in /etc/shadow.