Determine when an account was created?

On a non-AD Win2003 box, how could you determine when a particular account was created?
Who is Participating?
mcsweenConnect With a Mentor Sr. Network AdministratorCommented:
You would have to have security auditing on.  The one you are looking for is:
"Audit account management"

Make sure you edit the security log itself and make sure it's large enough that it won't start overwriting your events before you can look at them.
You could also check the date stamp on the profile folder under C:\Documents and Settings
mcsweenSr. Network AdministratorCommented:
I thought of that myself but after looking at the time/date stamp on my workstation it's dated 3/15/07 and it's been a couple months since I built this computer.  Unfortunatly it seems that will not work.
Dir c:\docume~1 /tc /ad

Admittedly, it does assume that the user logged in the same day the account was created.  But in the event that the logs have already been overwritten...
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.