Solved

Scan network for date of (XP) os install

Posted on 2006-06-27
22
1,369 Views
Last Modified: 2008-01-09
Good Morning.
AD Domain, 2,000 hosts, 99+% XP (few WIN2K, no other Windows versions).
Computers range in age from brand new to 7-8 years old.
130 remote WAN locations, with minimum T-1 to all remote sites.

I need a method to scan the entire network to determine the actual date of OS install, and generate it to a text format.

No VBS scripting allowed on network (don't ask and I won't tell).

If you need more information, let me know.

Thank you,
Vic
0
Comment
Question by:younghv
  • 9
  • 6
  • 4
  • +2
22 Comments
 

Expert Comment

by:NorwegianCoder
ID: 16991608
Searching online, I have managed to find a wide range of products which may satisfy your needs. As far as I know, another option would be to ask a coder to specifically make a program that can fetch the date of the OS install remotely from the registry. Personally I don't even know if Windows stores this date in it's registry.

Although I have no personal experience with these programs, as I have not had the possibility to try them out, I am hoping that some of them may help you with what you want.

http://downloads-zdnet.com.com/Network-Asset-Tracker/3000-2085_2-10551221.html
http://downloads-zdnet.com.com/sort/3150-2085-0-1-2.html
http://downloads-zdnet.com.com/Network-Inventory-Master/3000-2085_2-10550673.html?tag=lst-2-15


0
 
LVL 38

Author Comment

by:younghv
ID: 16991715
NC,
Thank you for the response.
The actual Registry location is:
regedit
9x
HKEY_LOCAL_MACHINE\software\microsoft\Windows\current version\
Dword "installDate"
NT/2k/xp
HKEY_LOCAL_MACHINE\software\microsoft\WindowsNT\current version\
Dword "installDate"

I have also been 'Googling' the net in hopes of finding what I need, but have had no luck yet.
Hopeful that someone here has a tested application that I can use this morning.
Thanks,
Vic
0
 
LVL 28

Assisted Solution

by:Michael Pfister
Michael Pfister earned 400 total points
ID: 16991978
Generate a list with all your computer names in a plain text file:

net view /domain:(your domain) > machinelist.txt

Use notepad to remove the starting and ending lines.

Put the following lines in a command line script(GetReg.Cmd):
----------- snip ----------
@echo off
rem Run through computer list
for /f %%a in (machinelist.txt) do call :QueryReg %%a
Goto :EOF

:QueryReg
SET COMP=%1
rem Query Registry of computer
for /f "skip=3 tokens=3" %%b in ('reg query "%COMP%\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate') do SET INSTDATE=%%b
If Errorlevel 1 Goto :Bad
Echo %COMP%;%INSTDATE% >> GoodComputer.txt
Goto :EOF
:Bad
Echo %COMP% >> BadComputer.txt
Goto :EOF
----------- snip ----------

It will create 2 text files:
GoodComputer.txt - a list of computers reached and reg key read, delimited with ;
BadComputer.txt - a list of computers it was unable to read the key from

You can import GoodComputer.txt in Excel and convert the InstallDate value to a readable date. The value read is the number of seconds since January 1st 1970 in hexadecimal.

Rerun the script with the contents of BadComputer.txt once a while to get hold of computers not switched on that often.

But it seems there are some bugs:

http://support.microsoft.com/kb/232227/en-us
0
 
LVL 38

Author Comment

by:younghv
ID: 16992693
mpfister,
Thank you.
I am running it right now and will get back to you.
Vic
0
 
LVL 38

Author Comment

by:younghv
ID: 16994063
mpfister,
I was able to generate the list with computer name and the install date in Hexadecimal (0x41ab2024???).
Any thoughts on how to convert the Hex code into a date?
Thank you,
Vic
0
 
LVL 41

Expert Comment

by:graye
ID: 16994225
If you organization deploys PCs from an "image" (like using Norton Ghost), then the date of "install" is actually the date of when the image was created.

That might be OK for you....  But In my case, I wanted to know the date the image was placed on the PC (the *real* install date).  So I used the creation date of a file that gets created when the PC is first added to the domain.  (C:\WINDOWS\system32\config\netlogon.ftl)
0
 
LVL 38

Author Comment

by:younghv
ID: 16994396
graye,
Thank you for the response.
We have used a wide variety of methods over the years (which is why I'm going through this exercise).

If you have a method for displaying the DATE of the netlogon.ftl file, please let me know.

I am running psinfo on the network right now, but the output is going to be very cumbersome to work with.

Thanks,
Vic
0
 

Expert Comment

by:NorwegianCoder
ID: 16994669
I found the following online. It seems to convert the installation date to a human-readable format. If yo implement this into your exisitng script, you should have something that is working:

@echo off
set Key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
set Val=InstallDate
for /f "tokens=3" %%A in (
'REG Query "%Key%" /v %Val%^|findstr /I "%Val%.*REG_"'
) do set Instsecs=%%A
set Inst
call :SecsToDate %Instsecs% YY MM DD HH NN SS
echo Installdate: %YY%-%MM%-%DD% %HH%:%NN%:%SS%
goto :eof
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:SecsToDate %secs% yy mm dd hh nn ss
::
:: By:   Ritchie Lawrence, updated 2002-07-24. Version 1.1
::       http://www.commandline.co.uk/lib/treeview/index.php
:: Func: Returns a calendar date and time of day from the number of
::       elapsed seconds since 1st January 1970 00:00:00. For
::       NT4/2000/XP/2003.
:: Args:
::  %1 seconds used to create calendar date and time of day (by val)
::  %2 var to receive year, 4 digits for all typical dates (by ref)
::  %3 var to receive month, 2 digits, 01 to 12 (by ref)
::  %4 var to receive day of month, 2 digits, 01 to 31 (by ref)
::  %5 var to receive hours, 2 digits, 00 to 23 (by ref)
::  %6 var to receive minutes, 2 digits, 00 to 59 (by ref)
::  %7 var to receive seconds, 2 digits, 00 to 59 (by ref)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
setlocal ENABLEEXTENSIONS
set /a i=%1,ss=i%%60,i/=60,nn=i%%60,i/=60,hh=i%%24,dd=i/24,i/=24
set /a a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2
set /a dd/=5,dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
(if %hh% LSS 10 set hh=0%hh%)&(if %nn% LSS 10 set nn=0%nn%)
if %ss% LSS 10 set ss=0%ss%
endlocal&set %7=%ss%&set %6=%nn%&set %5=%hh%&^
set %4=%dd%&set %3=%mm%&set %2=%yy%&goto :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
0
 
LVL 38

Author Comment

by:younghv
ID: 16995499
NC,
I have no idea what means or how to implement it into the existing script.
If you can do the implementing and test it, I would be glad to give it a try.
Thank you,
Vic
0
 

Accepted Solution

by:
NorwegianCoder earned 100 total points
ID: 16996001
I only have one PC to test this on, so I don't know if it will work with other PCs as well. Here are the scripts you need to run:

First of all, make test.cmd:
----------------------------------
@echo off
rem Run through computer list
for /f %%a in (machinelist.txt) do call :QueryReg %%a
Goto :EOF

:QueryReg
SET COMP=%1
rem Query Registry of computer
for /f "skip=3 tokens=3" %%b in ('reg query "%COMP%\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate') do SET INSTDATE=%%b
If Errorlevel 1 Goto :Bad
Echo %COMP%;%INSTDATE% >> GoodComputer.txt
Goto :EOF
:Bad
Echo %COMP% >> BadComputer.txt
Goto :EOF
-----------------------------------------------

To echo the installdates of the PCs located on the network, make date.cmd:
------------------------------------------------
set Key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
set Val=InstallDate
for /f %%a in (machinelist.txt) do set Instsecs=%%A
set Inst
call :SecsToDate %Instsecs% YY MM DD HH NN SS
echo Installdate: %YY%-%MM%-%DD% %HH%:%NN%:%SS%
goto :eof


setlocal ENABLEEXTENSIONS
set /a i=%1,ss=i%%60,i/=60,nn=i%%60,i/=60,hh=i%%24,dd=i/24,i/=24
set /a a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2
set /a dd/=5,dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
(if %hh% LSS 10 set hh=0%hh%)&(if %nn% LSS 10 set nn=0%nn%)
if %ss% LSS 10 set ss=0%ss%
endlocal&set %7=%ss%&set %6=%nn%&set %5=%hh%&^
set %4=%dd%&set %3=%mm%&set %2=%yy%&goto :EOF
--------------------------------------------------------

If there are any bugs with these kind of scripts, please let me know, so that I can try to correct them.

0
 

Expert Comment

by:NorwegianCoder
ID: 16996024
Sorry, forgot that you wanted it outputted to a text file, so here is a small edit to date.cmd:



set Key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
set Val=InstallDate
for /f %%a in (machinelist.txt) do set Instsecs=%%A
set Inst
call :SecsToDate %Instsecs% YY MM DD HH NN SS
echo Installdate: %YY%-%MM%-%DD% %HH%:%NN%:%SS% >> dates.txt
goto :eof


setlocal ENABLEEXTENSIONS
set /a i=%1,ss=i%%60,i/=60,nn=i%%60,i/=60,hh=i%%24,dd=i/24,i/=24
set /a a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2
set /a dd/=5,dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
(if %hh% LSS 10 set hh=0%hh%)&(if %nn% LSS 10 set nn=0%nn%)
if %ss% LSS 10 set ss=0%ss%
endlocal&set %7=%ss%&set %6=%nn%&set %5=%hh%&^
set %4=%dd%&set %3=%mm%&set %2=%yy%&goto :EOF
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Expert Comment

by:NorwegianCoder
ID: 16996033
As you can see, the dates are outputted into dates.txt
0
 
LVL 3

Expert Comment

by:TomTinsley
ID: 16996430
You could also use WMI scripts.  Here is a small one that will get the info on a local machine.

Dim wmiColl, wmiObj
Set wmiColl = GetObject("WinMgmts:root/cimv2").ExecQuery("Select * FROM Win32_OperatingSystem")

For Each wmiObj In wmiColl
      WScript.Echo wmiObj.InstallDate
Next



It returns something like 20050727101215.000000-240
0
 
LVL 41

Expert Comment

by:graye
ID: 16997374
I get the impression that you're frustrated by all of the ideas and "potential solutions" but are still waiting for someone to provide a complete solution.  Is that the case?

If so, I can offer you some VB.Net source code that, when compiled, will scan the network and produce a microsoft access database with the data you seek.   My applications are only available as "source code", which means that you'll have to have a copy of Visual Basic .Net (or the free Visual Basic 2005 Express Edition) in order to compile it into an real application.

If you're interested, let me know and I'll put something together and put it on my web page for you.

0
 
LVL 38

Author Comment

by:younghv
ID: 16997464
graye,
Not at all - I just got home about an hour ago and have been away from the computer since I left work (Eastern Time here).
mpfister's script ran well, but generated a 'Hex' result (the number of seconds between 1-1-1970 and when the OS was loaded).

I opened his result in Excel and have two columns.
A is the computer name and
B is the Hex result.

If I could figure out how to convert the Hex result into a date (Excel 2003), this question would be closed.

Thanks for checking back in.
Vic
0
 
LVL 38

Author Comment

by:younghv
ID: 16997468
Also, I will try the NorwegianCoders script when I get back on the network.
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 16999172
younghv, I try to get an English Excel here to provide you with the neccessary conversion formula...
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 16999203
Sorry, unable to get an English Excel fast, so I merged the 2 scripts:

@echo off
rem Run through computer list
for /f %%a in (machinelist.txt) do call :QueryReg %%a
Goto :EOF

:QueryReg
SET COMP=%1
rem Query Registry of computer
for /f "skip=3 tokens=3" %%b in ('reg query "%COMP%\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate') do SET INSTDATE=%%b
If Errorlevel 1 Goto :Bad
call :SecsToDate %INSTDATE% YY MM DD HH NN SS

rem You can modify the output here, i.e. omit hour, minute and seconds...
Echo %COMP%;%YY%-%MM%-%DD% %HH%:%NN%:%SS%>> GoodComputer.txt
Goto :EOF
:Bad
Echo %COMP% >> BadComputer.txt
Goto :EOF

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:SecsToDate %secs% yy mm dd hh nn ss
::
:: By:   Ritchie Lawrence, updated 2002-07-24. Version 1.1
::       http://www.commandline.co.uk/lib/treeview/index.php
:: Func: Returns a calendar date and time of day from the number of
::       elapsed seconds since 1st January 1970 00:00:00. For
::       NT4/2000/XP/2003.
:: Args:
::  %1 seconds used to create calendar date and time of day (by val)
::  %2 var to receive year, 4 digits for all typical dates (by ref)
::  %3 var to receive month, 2 digits, 01 to 12 (by ref)
::  %4 var to receive day of month, 2 digits, 01 to 31 (by ref)
::  %5 var to receive hours, 2 digits, 00 to 23 (by ref)
::  %6 var to receive minutes, 2 digits, 00 to 59 (by ref)
::  %7 var to receive seconds, 2 digits, 00 to 59 (by ref)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
setlocal ENABLEEXTENSIONS
set /a i=%1,ss=i%%60,i/=60,nn=i%%60,i/=60,hh=i%%24,dd=i/24,i/=24
set /a a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2
set /a dd/=5,dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
(if %hh% LSS 10 set hh=0%hh%)&(if %nn% LSS 10 set nn=0%nn%)
if %ss% LSS 10 set ss=0%ss%
endlocal&set %7=%ss%&set %6=%nn%&set %5=%hh%&^
set %4=%dd%&set %3=%mm%&set %2=%yy%&goto :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Goto :EOF
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 16999307
PS: not sure if Ritchie Lawrence's conversion routine takes leap years into calculation. A bit difficult to understand what he's doing here...
0
 
LVL 38

Author Comment

by:younghv
ID: 16999559
mpfister -
Thank you for following up.
I will check this out and get back to you.
Vic
0
 

Expert Comment

by:NorwegianCoder
ID: 16999920
Hi there. I merged the two scripts and tested them out myself earlier, and they seemed to work, so it basically seems like me and mpfister did the same work, but I did it before him.

0
 
LVL 38

Author Comment

by:younghv
ID: 17000279
Thank you both for working on this.
I understand what is involved with solving someone else's questions.
No idea why NC ended up as 'accepted' and mpfister as 'assisted' - should have been the other way around.
mpfister - 400 points
NC - 100

mpfister - your first answer took me 80% of where I wanted to be.
One of the guys here at work did some scripting magic and converted all of the Hex values to Day-Month-Year.

The second answers (Ritchie Lawrence) worked like a charm and I will play with it to remove the hours, minutes, and seconds.

NC - If you review mpfister's answers, you will note that he put the entire code in one post. That made it easy for me to just 'cut and paste' the solution into one file.  Telling an applications guy to 'edit' or 'merge' anything to do with code is a lost cause.

Again, thank you both.

Vic
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
This video discusses moving either the default database or any database to a new volume.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now