You could probably check the time stamp on the password file.
On Mon, Jan 7, 2019 at 12:26 PM MacGregor, Ian A. <
dmarc-noreply@xxxxxxxxxxxxx> wrote:
We use the ptime column of the sys.user$ table to monitor password
change times. This still works for a normal user, but for sys the value
does nit change. This is true whether "alter user" or the password command
is used.
Ian A. MacGregor
SLAC National Accelerator Laboratory