A launch daemon that logs when /var/db/.AppleSetup done is created or modified.

AppleSetupDoneWatcher.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
     <key>Label</key>
     <string>com.arekdreyer.AppleSetupDoneWatcher</string>
     <key>ProgramArguments</key>
     <array>
          <string>/usr/bin/logger</string>
          <string>"/var/db/.AppleSetupDone was created/modified."</string>
     </array>
     <key>WatchPaths</key>
     <array>
           <string>/var/db/.AppleSetupDone</string>
     </array>
</dict>
</plist>