This topic contains 4 replies, has 4 voices, and was last updated by
February 4, 2015 at 6:25 am #22347ParticipantPoints: 0Rank: Member
I consider myself still learning Powershell as there are a lot to it. However, found a script online since time is an issue for me and started to play with it.
Get–WmiObject -Class win32_useraccount -Namespace "root\cimv2" -Filter "localAccount='$True'"
I am actually looking for the creation date and I am having issues trying to find the Property to display a creation date. I personally do not care how I achieve this goal as long as I can achieve it. Any help would be great.
Thank you in advance
February 4, 2015 at 6:37 am #22348ParticipantPoints: 5Rank: Member
I think this will be challenging. It's held in the SAM account database and as far as I'm aware, Microsoft don't make this property accessible by default.
Two options I see are that if you've auditing turned on, you could look into the event log with PowerShell. Alternatively, another option could be to look at the date created attribute for the relevant user in the users folder, but this is really only telling what date a user first logged onto the system, not the date created. It will also be invalid if their profile has been cleaned since its creation date.
February 4, 2015 at 6:48 am #22351KeymasterPoints: 7Rank: Member
The class documentation is at https://msdn.microsoft.com/en-us/library/aa394507(v=vs.85).aspx. It looks to me like the only possible property would be InstallDate; if that isn't populated with a value, then the information isn't being tracked by Windows.
February 4, 2015 at 6:55 am #22352MemberPoints: 0Rank: Member
According to Richard Mueller (who's pretty much the man when it comes to Windows IAM stuff), the only way you could get that information is from audit logs (assuming you've archived them.) https://social.technet.microsoft.com/Forums/en-US/617374de-a90e-498b-ba1e-f43b77cf0345/date-of-local-id-creation
February 5, 2015 at 6:42 pm #22393ParticipantPoints: 0Rank: Member
I would like to thank everyone for the input. My research was saying the same thing and I was hoping I just did not come across that hidden document.
The topic ‘Get Local User Creation Date’ is closed to new replies.