FYI it looks like we can no longer query plists in the

/var/db/dslocal/nodes/Default

location as of Mojave, even running the query as root eg.

SELECT value FROM plist WHERE path = '/private/var/db/dslocal/nodes/Default/users/' || (SELECT user FROM logged_in_users ORDER BY time DESC LIMIT 1) || '.plist' AND key = "realname";