Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to get the creation date of a local user account (Win 7 if it matters). I've looked at the following WMI objects (and google of course):

Win32_UserAccount Win32_NetworkLoginProfile

The objects returned from NetworkLoginProfile have the last login time, but not the creation date. Checking the Date Created property of their profile folder merely gives the date that folder was created, not necessarily the account itself.

share|improve this question
To add from chat: I can see the user hive in the registry creation date, but that's only based on their first login, not account creation date. – TheCleaner Apr 11 '14 at 19:42
up vote 10 down vote accepted

The data is in the SAM but it doesn't appear to be publicly documented by Microsoft and I'm not finding an official API to retrieve it. I can see, looking at the source code for the chntpw utility that the value is stored in the "F" registry key for each account. Quoth the source code:

#define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F"

struct user_F {
  char t_creation[8]; /* Time of account creation */

The regripper forensics project has a plugin, samparse that will report the account creation date.

A forensics tool probably isn't what you want, but it looks like Microsoft isn't making it easy.

In researching this I did find it amusing that a Microsoft MVP didn't know that the account creation data is stored in the SAM. To his benefit maybe he isn't away of the chntpw utility, which is where I started my search for information about undocumented SAM structures.

share|improve this answer
your ideas are intriguing to me and I wish to ---subscribe to your newsletter--- , I mean learn how to use this tool to try this myself. Would you, perchance, have any linkage I might avail myself of to that end? (Damn you markdown!) – HopelessN00b Apr 11 '14 at 20:40
Just the link to the regripper project above. I haven't used it, personally, but it looks reasonably easy to deal with. It looks like it has been included in Kali Linux now ( if you'd rather just boot a live CD versus installing a Perl environment to run regripper. Apparently there was a book written around these tools. It looks pricey:… I should probably play around with these tools at some point-- I just haven't had the occasion to. – Evan Anderson Apr 11 '14 at 20:50
I think Evan might owe Richard Mueller an apology ;) – charleswj81 Apr 20 '14 at 1:57
I didn't give the tools a try. Are you finding that the date isn't getting populated? – Evan Anderson Apr 20 '14 at 1:59
Not sure if you saw my own answer below yet, but the field being referred to as "creation date" is actually "password last changed", which obviously will be the same value until the first post-account creation password change. – charleswj81 Apr 26 '14 at 3:43

The only way to actually know would be to have account management auditing enabled on the computer when the account was created. Then, you'd see EventID 4720 in the Event Log at the creation date. (The article says Active Directory, but the same applies to local accounts as well; I checked.)

Without that, the closest you can come is by checking the creation date on the user's registry hive, ntuser.dat file, user profile folder etc., but as mentioned in the comments, this is only accurate regarding the user's first logon, as that's when those things are created.

Unfortunately for you, this is a case of "if you didn't log it, then that information doesn't exist."

share|improve this answer

I was about to give you a POC PowerShell script to extract and parse out the creation time, but I realized that chntpw's logic is incorrect. The value it calls the creation time is actually the password last set time, although these values are the same upon the initial account creation. See here for an exhaustive description of the SAM.

Evan's second link, for samparse, might get it right though. Looking at its actually does work. If you look at its source here, line 99:

$c_date = $create->get_timestamp();

you'll see it calls get_timestamp from Perl's Parse::Win32Registry. I'm pretty sure that is actually the last write time of the key. Since it appears that particular key (HKLM\SAM\SAM\Domains\Account\Users\Names\<USERNAME>) only holds a pointer to the corresponding RID key, it shouldn't change after creation and the last write time will be equal to the creation time.

I you want to stick with more built-in tools, here is a series of Scripting Guy articles explaining how via PowerShell:

Use PowerShell to Access Registry Last-Modified Time Stamp

Reusing PowerShell Registry Time Stamp Code

Create a Proxy Function to Display Registry Key Time Stamps

Leverage Registry Key Time Stamps via PowerShell

share|improve this answer

Navigate via My Computer to

C:\Users and you will see all the user accounts listed on the local machine. You can right click the appropriate user account and go to properties and it will show you a date created, this should be the same as the creation of the user account

Just my 2 cents

share|improve this answer
-1 - That shows you when the profile directory was created. That doesn't tell you when the account was created since the profile directory could be deleted and re-created at any time after the account was created. – Evan Anderson Dec 9 '14 at 14:52
While that is possible, 99% of the time it will be accurate, and this is good enough for most – Kevin Dec 9 '14 at 15:05
I was always told to keep it simple... seems both of us get about the same answer, you had to go write a program, and i just took the data already available in front of you – Kevin Dec 9 '14 at 15:06
Sorry Kevin, almost doesn't cut it for this particular solution. Specifically, this had to be done for computers in a lab, where the profile folders had to be deleted on a regular basis to keep the login times acceptable and wasted space down, so this solution is in no way plausible, as that date is just a folder creation date, not a user profile creation date. – BigHomie Dec 9 '14 at 15:12
@Kevin The "keep it simple" answer is mine, which is that it can't be done, unless auditing was enabled prior to the account creation, though the creation of user's registry hive, ntuser.dat file or user profile folder may provide an approximation. The complex answer is EvanAnderson's, which does actually work, to my surprise. – HopelessN00b Dec 9 '14 at 15:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.