I appologize in advance, my question would be easly for me to research
if I actually had a Solaris server that I had access to. And I am googled out.

I am auditing a solaris 9.0 server's passwords (I was sent the passwd and shadow files) and need to know when the *LK*actually happens.

In the shadow file I see several accounts that have their passwords set to expire at 35 days, an inactivity timer of 91 days, and the lastchanged date is several months past the 35 and 91 days, respectfively, yet the account doesn't indicate its been locked (*LK*).

I am assuming the *LK* condition won't actually show-up in the shadow file until the user tries to log-in again. Which if true would indicate old accounts that should be removed. Is this correct or is something broken. Thanks.