How to Determine the Windows Installation Date with and without PowerShell
There are many ways to determine when Windows was installed. Here are some of them.
Systeminfo
The systeminfo tool displays a lot of interesting information about the computer and the operating system, among them the installation date. Here is some sample output:
Host Name: WIN7
OS Name: Microsoft Windows 7 Enterprise
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Original Install Date: 9/17/2009, 3:58:54 PM <<==
System Boot Time: 9/24/2009, 10:34:34 AM
...
WMI
The install date is stored in the property InstallDate of the WMI class Win32_OperatingSystem. Without conversion, we would get a string like “20090917155854.000000+120”.
PS C:\> ([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).InstallDate)
Thursday, September 17, 2009 3:58:54 PM
Registry
The install date is stored in the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate as UNIX time (32-bit value containing the number of seconds since 1/1/1970).
PS C:\> [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($(get-itemproperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion').InstallDate))
Thursday, September 17, 2009 3:58:54 PM
What does not work
I first came up with the idea of querying the creation time of the Windows folder. This does not work because, beginning with Vista, the setup process is image-based. The only thing we can learn from querying the creation date of the Windows folder is when the installation image was created by Microsoft.
PS C:\> (Get-Item "$env:windir").creationtime
Tuesday, July 14, 2009 4:37:05 AM
My second idea was to use the creation date of a file or folder created right after setup. Here is how I looked for a likely candidate:
PS C:\> gci c: -force | where {$_.creationtime -lt "09.19.2009" -and
$_.creationtime -gt "09.16.2009"} |
select fullname,creationtime | sort creationtime
FullName CreationTime
-------- ------------
C:\Recovery 9/17/2009 3:58:50 PM
C:\temp 9/17/2009 10:02:46 PM
C:\System Volume Information 9/18/2009 12:43:30 AM
C:\hiberfil.sys 9/18/2009 12:43:30 AM
C:\pagefile.sys 9/18/2009 12:43:32 AM
Of these results, only the folder “Recovery” is pretty much identical to the “official” install date as recorded by Windows. But using such a method seems way too fragile for production use.
Another failed attempt is to use the date of the oldest event log entry as can be seen from the following screen shot:
3 Comments
Here is a little VBS Snippit. Works at least on XP / VISTA / 7:
For Each i in GetObject(\"winmgmts:{impersonationLevel=impersonate}\")._
ExecQuery(\"Select CurrentTimeZone, InstallDate From Win32_OperatingSystem\")
With CreateObject(\"WbemScripting.SWbemDateTime\")
.Value = i.InstallDate
MsgBox \"OS Installed: \" & DateAdd(\"n\", -i.CurrentTimeZone, .GetVarDate)
End With
Next
How do I run The WMI script against a remote machine?
It looks like the scripting guys at Microsoft answered your question:
You were on the right track with the first command — just add the -ComputerName parameter to the Get-WmiObject cmdlet.
([WMI] “”).ConvertToDateTime((Get-WmiObject Win32_OperatingSystem -ComputerName computername).InstallDate)
Found here: http://social.technet.microsoft.com/Forums/en/ITCG/thread/1bf16548-7c22-40dc-8fb2-89862926702a