Is there anyway to find out the date that a local user account was created on
a Windows XP Pro system?

Probably several ways. Here's one.

Open C:\Documents and Settings
Right click on the user's name folder and click Properties.
Look at the Created date on the General tab.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:15F3041A-E1B5-4503-9DCD-(E-Mail Removed),
Alan <(E-Mail Removed)> hunted and pecked:
> Is there anyway to find out the date that a local user account was
> created on a Windows XP Pro system?

If a user account was created but the user has never logged on there
wouldn't be a profile created under "Documents and Settings".

If you have security auditing turned on, look in the security event
log for Account Management entries. A sample entry would look like the
following:

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 624
Date: 1/27/2007
Time: 12:04:30 PM
User: ABCDE\Administrator
Computer: ABCDE
Description:
User Account Created:
New Account Name: DemoNewUser
New Domain: ABCDE
New Account ID: ABCDE\DemoNewUser
Caller User Name: Administrator
Caller Domain: ABCDE
Caller Logon ID: (0x0,0x10F95)
Privileges -

Another way to perhaps get an idea of when the account was created if
no log entries exist would be to go to a command prompt and type "net
user UserName" where UserName is the ID you want to see. That will at
least give you the date the password was last set.

HTH



"Wesley Vogel" <(E-Mail Removed)> wrote:

>Probably several ways. Here's one.
>
>Open C:\Documents and Settings
>Right click on the user's name folder and click Properties.
>Look at the Created date on the General tab.


Ha®®y

(E-Mail Removed)

The command net user username may also help. The password set date can be an
indication if the password had never been changed as is often the case.

Steve


<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> If a user account was created but the user has never logged on there
> wouldn't be a profile created under "Documents and Settings".
>
> If you have security auditing turned on, look in the security event
> log for Account Management entries. A sample entry would look like the
> following:
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Account Management
> Event ID: 624
> Date: 1/27/2007
> Time: 12:04:30 PM
> User: ABCDE\Administrator
> Computer: ABCDE
> Description:
> User Account Created:
> New Account Name: DemoNewUser
> New Domain: ABCDE
> New Account ID: ABCDE\DemoNewUser
> Caller User Name: Administrator
> Caller Domain: ABCDE
> Caller Logon ID: (0x0,0x10F95)
> Privileges -
>
> Another way to perhaps get an idea of when the account was created if
> no log entries exist would be to go to a command prompt and type "net
> user UserName" where UserName is the ID you want to see. That will at
> least give you the date the password was last set.
>
> HTH
>
>
>
> "Wesley Vogel" <(E-Mail Removed)> wrote:
>
>>Probably several ways. Here's one.
>>
>>Open C:\Documents and Settings
>>Right click on the user's name folder and click Properties.
>>Look at the Created date on the General tab.
>
>
> Ha®®y
>
> (E-Mail Removed)