Get Local User Creation Date

This topic contains 4 replies, has 4 voices, and was last updated by Profile photo of Mark DiPofi Mark DiPofi 1 year, 10 months ago.

  • Author
    Posts
  • #22347
    Profile photo of Mark DiPofi
    Mark DiPofi
    Participant

    I consider myself still learning Powershell as there are a lot to it. However, found a script online since time is an issue for me and started to play with it.

    Get–WmiObject -Class win32_useraccount -Namespace "root\cimv2" -Filter "localAccount='$True'"

    I am actually looking for the creation date and I am having issues trying to find the Property to display a creation date. I personally do not care how I achieve this goal as long as I can achieve it. Any help would be great.

    Thank you in advance

  • #22348
    Profile photo of Tim Pringle
    Tim Pringle
    Participant

    I think this will be challenging. It's held in the SAM account database and as far as I'm aware, Microsoft don't make this property accessible by default.

    Two options I see are that if you've auditing turned on, you could look into the event log with PowerShell. Alternatively, another option could be to look at the date created attribute for the relevant user in the users folder, but this is really only telling what date a user first logged onto the system, not the date created. It will also be invalid if their profile has been cleaned since its creation date.

  • #22351
    Profile photo of Don Jones
    Don Jones
    Keymaster

    The class documentation is at https://msdn.microsoft.com/en-us/library/aa394507(v=vs.85).aspx. It looks to me like the only possible property would be InstallDate; if that isn't populated with a value, then the information isn't being tracked by Windows.

  • #22352
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    According to Richard Mueller (who's pretty much the man when it comes to Windows IAM stuff), the only way you could get that information is from audit logs (assuming you've archived them.) https://social.technet.microsoft.com/Forums/en-US/617374de-a90e-498b-ba1e-f43b77cf0345/date-of-local-id-creation

  • #22393
    Profile photo of Mark DiPofi
    Mark DiPofi
    Participant

    I would like to thank everyone for the input. My research was saying the same thing and I was hoping I just did not come across that hidden document.

    Thank you

You must be logged in to reply to this topic.