Slight adjust audit_etcpasswd to act like a find_first_result