Does OS X store information in any log about when an administrator changes the user level of a certain user - by selecting “Allow user to administer this computer” under users in systems preferences? Background: We noticed that a certain user suddenly has admin privileges but would like to know who granted them and when. Which log file did we have to check? syslog doesn't seem the right one (in El Capitan and Sierra). Thank you.