• Welcome to Tux Reports: Where Penguins Fly. We hope you find the topics varied, interesting, and worthy of your time. Please become a member and join in the discussions.

How to validate User ID creation date in Windows XP

M

m_bk

Flightless Bird
Is there a way to validate the creation date of local User IDs in Windows
XP/2003?
 
J

John John - MVP

Flightless Bird
m_bk wrote:
> Is there a way to validate the creation date of local User IDs in Windows
> XP/2003?


You could query the Security Log but you will only get the information
if the log was setup to record events 624 and providing that the log
wasn't purged or overwritten:

cscript c:/windows\system32\eventquery.vbs /L security /FI "id eq 624"


Other than that verifying the creation date on the user's profile folder
is the only way that I know of to get the information.

John
 
B

Bernd

Flightless Bird
-------- Original-Nachricht --------

> Is there a way to validate the creation date of local User IDs in Windows
> XP/2003?


Look at the creation date of the folder c:/Documents and Settings\<UserID>

Bernd
 
M

m_bk

Flightless Bird
Thanks Bernd,

But we are talking about an installation which is a couple of years old and
the user profile was deleted and re-created.

Wanted to check if the data/time stamp is recorded in the system somewhere
like in Active Directory (one of the user attribute I guess records the
creation date/time).

m_bk

"Bernd" wrote:

>
>
> -------- Original-Nachricht --------
>
> > Is there a way to validate the creation date of local User IDs in Windows
> > XP/2003?

>
> Look at the creation date of the folder c:/Documents and Settings\<UserID>
>
> Bernd
> .
>
 
B

Bernd

Flightless Bird
-------- Original-Nachricht --------

> Thanks Bernd,
>
> But we are talking about an installation which is a couple of years old and
> the user profile was deleted and re-created.
>
> Wanted to check if the data/time stamp is recorded in the system somewhere
> like in Active Directory (one of the user attribute I guess records the
> creation date/time).
>


Oh, I don't know, but I think Windows will not recognize that you
re-created a deleted user profile.
The only idea I have is looking for a reused entry in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-xxxxxxxxx

But I don't know how to get the creation date of that entry.
The last modified date you can get by exporting that key as txt file.

Sorry, Bernd
 
Top