Prev: USB optical mouse
Next: Office2003
From: m_bk on 10 Jun 2010 08:40
Is there a way to validate the creation date of local User IDs in Windows
XP/2003?
From: John John - MVP on 10 Jun 2010 09:45
m_bk wrote:
> Is there a way to validate the creation date of local User IDs in Windows
> XP/2003?

You could query the Security Log but you will only get the information
if the log was setup to record events 624 and providing that the log
wasn't purged or overwritten:

cscript c:\windows\system32\eventquery.vbs /L security /FI "id eq 624"


Other than that verifying the creation date on the user's profile folder
is the only way that I know of to get the information.

John
From: Bernd on 10 Jun 2010 09:54


-------- Original-Nachricht --------

> Is there a way to validate the creation date of local User IDs in Windows
> XP/2003?

Look at the creation date of the folder c:\Documents and Settings\<UserID>

Bernd
From: m_bk on 11 Jun 2010 00:41
Thanks Bernd,

But we are talking about an installation which is a couple of years old and
the user profile was deleted and re-created.

Wanted to check if the data/time stamp is recorded in the system somewhere
like in Active Directory (one of the user attribute I guess records the
creation date/time).

m_bk

"Bernd" wrote:

>
>
> -------- Original-Nachricht --------
>
> > Is there a way to validate the creation date of local User IDs in Windows
> > XP/2003?
>
> Look at the creation date of the folder c:\Documents and Settings\<UserID>
>
> Bernd
> .
>
From: Bernd on 11 Jun 2010 14:27


-------- Original-Nachricht --------

> Thanks Bernd,
>
> But we are talking about an installation which is a couple of years old and
> the user profile was deleted and re-created.
>
> Wanted to check if the data/time stamp is recorded in the system somewhere
> like in Active Directory (one of the user attribute I guess records the
> creation date/time).
>

Oh, I don't know, but I think Windows will not recognize that you
re-created a deleted user profile.
The only idea I have is looking for a reused entry in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-1-5-21-xxxxxxxxx

But I don't know how to get the creation date of that entry.
The last modified date you can get by exporting that key as txt file.

Sorry, Bernd
 | 
Pages: 1
Prev: USB optical mouse
Next: Office2003