Find Guest/Anonymous user details

Question

Is there any way to find out who all are connected to a mac/MBP, find the files accessed and how long he has been connected?

May be list all the files/folders he has accessed copied, etc.

Answer 1

One of those actions is available with a preloaded UNIX utility, w. By opening up Terminal.app and typing w + return at the prompt, you will be shown an output similar to the below:

Last login: Sun Jan  9 15:21:58 from server.lan
blackcomb:~ tyson$ w
15:24  up 2 days,  4:27, 4 users, load averages: 0.52 0.45 0.45
USER     TTY      FROM              LOGIN@  IDLE WHAT
tyson    console  -                Fri10   2days -
tyson    s000     -                15:21       - ssh [e-mail]
tyson    s001     server.lan       15:23       - -bash
tyson    s002     -                15:23       - w

Here's a breakdown of each line:

• The first line displays the current time (15:24), the uptime (2 days, 4h, 27m), how many users are currently logged in (4) and the load averages (over a 1, 5, and 15 minute period).
• The third line is me logged into the graphical environment (the console) of OS X. I logged in on Friday, and I have been logged in for 2 days.
• The fourth line is a terminal window I have open (tty s000) where I am running SSH.
• The fifth line is the ssh session I've opened from my server to my Mac, and it's currently idle running bash.
• The sixth line is the third TTY I have open where I am running the w command from.

This information can be combined with lsof to list open files. For instance, running lsof -u root would show all files, folders and pipes currently open by root.

I know this is only a partial answer, but I hope it does some of what you're looking for!