Is there anything in CA-ACF2 that will show when a LOGONID was created?
There was an enhancement in CA-ACF2 r12 that adds a new field called CRE-TOD to the LOGONID record to accomplish this.
The CRE-TOD field indicates the date and time that a LOGONID record was created. CA ACF2 displays the date in the format mm/dd/yy, dd/mm/yy, or yy/mm/dd, depending on the DATE field of the GSO OPTS record.
New LOGONIDs that are inserted with CA-ACF2 r12 and above will be created with the new CRE-TOD field. LOGONIDS that were created prior to CA-ACF2 r12 will have CRE-TOD(00/00/00-00:00). You can change the date, but you cannot change the time. You cannot specify a date in the future. You must have the SECURITY or ACCOUNT privilege to alter this field.
The CRE-TOD appears under the STATISTICS portion of the LOGONID LIST as shown below.
? insert testusr name(test create date)
TESTUSR TESTUSR TEST CREATE DATE
ACCESS ACC-CNT(0) ACC-DATE(00/00/00) ACC-TIME(00:00)
PASSWORD KERB-VIO(0) KERBCURV() PSWD-DAT(00/00/00) PSWD-INV(0)
PSWD-TOD(00/00/00-00:00) PSWD-VIO(0) PSWDCVIO(0)
STATISTICS CRE-TOD(28/10/08-07:37) SEC-VIO(0) UPD-TOD(28/10/08-07:37)
For more information on the CRE-TOD LOGONID field, see the CA-ACF2 for z/OS Administrator Guide.