Get Local User Creation Date

I consider myself still learning Powershell as there are a lot to it. However, found a script online since time is an issue for me and started to play with it.

Get–WmiObject -Class win32_useraccount -Namespace “root\cimv2” -Filter “localAccount=’$True’”

I am actually looking for the creation date and I am having issues trying to find the Property to display a creation date. I personally do not care how I achieve this goal as long as I can achieve it. Any help would be great.

Thank you in advance

I think this will be challenging. It’s held in the SAM account database and as far as I’m aware, Microsoft don’t make this property accessible by default.

Two options I see are that if you’ve auditing turned on, you could look into the event log with PowerShell. Alternatively, another option could be to look at the date created attribute for the relevant user in the users folder, but this is really only telling what date a user first logged onto the system, not the date created. It will also be invalid if their profile has been cleaned since its creation date.

The class documentation is at It looks to me like the only possible property would be InstallDate; if that isn’t populated with a value, then the information isn’t being tracked by Windows.

According to Richard Mueller (who’s pretty much the man when it comes to Windows IAM stuff), the only way you could get that information is from audit logs (assuming you’ve archived them.)

I would like to thank everyone for the input. My research was saying the same thing and I was hoping I just did not come across that hidden document.

Thank you