Is there a way get the timestamp of when a user account was marked locked?
I'm trying to show that a locked out user had an existing open connection
before the lockout happened. The next process that ran through a pam login
was properly denied but the screen shot indicates they were already on a
system.
And, yes, policy change will include the account lock followed by an
aggressive kill -9 of all running process on all nodes.