How to validate User ID creation date in Windows XP

[m_bk]

Is there a way to validate the creation date of local User IDs in Windows
XP/2003?

 

[John John - MVP]

Is there a way to validate the creation date of local User IDs in Windows
XP/2003?

You could query the Security Log but you will only get the information
if the log was setup to record events 624 and providing that the log
wasn't purged or overwritten:

cscript c:\windows\system32\eventquery.vbs /L security /FI "id eq 624"


Other than that verifying the creation date on the user's profile folder
is the only way that I know of to get the information.

John

 

[Bernd]

-------- Original-Nachricht --------

Is there a way to validate the creation date of local User IDs in Windows
XP/2003?

Look at the creation date of the folder c:\Documents and Settings\<UserID>

Bernd

 

[m_bk]

Thanks Bernd,

But we are talking about an installation which is a couple of years old and
the user profile was deleted and re-created.

Wanted to check if the data/time stamp is recorded in the system somewhere
like in Active Directory (one of the user attribute I guess records the
creation date/time).

m_bk

 

[Bernd]

-------- Original-Nachricht --------

Thanks Bernd,

But we are talking about an installation which is a couple of years old and
the user profile was deleted and re-created.

Wanted to check if the data/time stamp is recorded in the system somewhere
like in Active Directory (one of the user attribute I guess records the
creation date/time).

Oh, I don't know, but I think Windows will not recognize that you
re-created a deleted user profile.
The only idea I have is looking for a reused entry in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-xxxxxxxxx

But I don't know how to get the creation date of that entry.
The last modified date you can get by exporting that key as txt file.

Sorry, Bernd