I'm hoping this is an easy one.

I work for a school system, and we think that a kid may have hacked eDir creating a user ID Administrator with supervisor rights.

Is there a way to find out whick user ID(who) created that user ID and when?

Thanks/
Pete