1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How to validate User ID creation date in Windows XP

Discussion in 'Windows XP' started by m_bk, Jun 10, 2010.

  1. m_bk

    m_bk Flightless Bird

    Is there a way to validate the creation date of local User IDs in Windows
    XP/2003?
     
  2. John John - MVP

    John John - MVP Flightless Bird

    m_bk wrote:
    > Is there a way to validate the creation date of local User IDs in Windows
    > XP/2003?


    You could query the Security Log but you will only get the information
    if the log was setup to record events 624 and providing that the log
    wasn't purged or overwritten:

    cscript c:/windows\system32\eventquery.vbs /L security /FI "id eq 624"


    Other than that verifying the creation date on the user's profile folder
    is the only way that I know of to get the information.

    John
     
  3. Bernd

    Bernd Flightless Bird

    -------- Original-Nachricht --------

    > Is there a way to validate the creation date of local User IDs in Windows
    > XP/2003?


    Look at the creation date of the folder c:/Documents and Settings\<UserID>

    Bernd
     
  4. m_bk

    m_bk Flightless Bird

    Thanks Bernd,

    But we are talking about an installation which is a couple of years old and
    the user profile was deleted and re-created.

    Wanted to check if the data/time stamp is recorded in the system somewhere
    like in Active Directory (one of the user attribute I guess records the
    creation date/time).

    m_bk

    "Bernd" wrote:

    >
    >
    > -------- Original-Nachricht --------
    >
    > > Is there a way to validate the creation date of local User IDs in Windows
    > > XP/2003?

    >
    > Look at the creation date of the folder c:/Documents and Settings\<UserID>
    >
    > Bernd
    > .
    >
     
  5. Bernd

    Bernd Flightless Bird

    -------- Original-Nachricht --------

    > Thanks Bernd,
    >
    > But we are talking about an installation which is a couple of years old and
    > the user profile was deleted and re-created.
    >
    > Wanted to check if the data/time stamp is recorded in the system somewhere
    > like in Active Directory (one of the user attribute I guess records the
    > creation date/time).
    >


    Oh, I don't know, but I think Windows will not recognize that you
    re-created a deleted user profile.
    The only idea I have is looking for a reused entry in

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\ProfileList\S-1-5-21-xxxxxxxxx

    But I don't know how to get the creation date of that entry.
    The last modified date you can get by exporting that key as txt file.

    Sorry, Bernd
     

Share This Page