How to validate User ID creation date in Windows XP

[m_bk]

Is there a way to validate the creation date of local User IDs in Windows

XP/2003?

 

[John John - MVP]

m_bk wrote:

> Is there a way to validate the creation date of local User IDs in Windows

> XP/2003?



You could query the Security Log but you will only get the information

if the log was setup to record events 624 and providing that the log

wasn't purged or overwritten:



cscript c:\windows\system32\eventquery.vbs /L security /FI "id eq 624"





Other than that verifying the creation date on the user's profile folder

is the only way that I know of to get the information.



John

 

[Bernd]

-------- Original-Nachricht --------



> Is there a way to validate the creation date of local User IDs in Windows

> XP/2003?



Look at the creation date of the folder c:\Documents and Settings\



Bernd

 

[m_bk]

Thanks Bernd,



But we are talking about an installation which is a couple of years old and

the user profile was deleted and re-created.



Wanted to check if the data/time stamp is recorded in the system somewhere

like in Active Directory (one of the user attribute I guess records the

creation date/time).



m_bk



"Bernd" wrote:



>

>

> -------- Original-Nachricht --------

>

> > Is there a way to validate the creation date of local User IDs in Windows

> > XP/2003?

>

> Look at the creation date of the folder c:\Documents and Settings\

>

> Bernd

> .

>

 

[Bernd]

-------- Original-Nachricht --------



> Thanks Bernd,

>

> But we are talking about an installation which is a couple of years old and

> the user profile was deleted and re-created.

>

> Wanted to check if the data/time stamp is recorded in the system somewhere

> like in Active Directory (one of the user attribute I guess records the

> creation date/time).

>



Oh, I don't know, but I think Windows will not recognize that you

re-created a deleted user profile.

The only idea I have is looking for a reused entry in



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\ProfileList\S-1-5-21-xxxxxxxxx



But I don't know how to get the creation date of that entry.

The last modified date you can get by exporting that key as txt file.



Sorry, Bernd