How to Determine the Windows Installation Date with and without PowerShell
There are many ways to determine when Windows was installed. Here are some of them.
Systeminfo
The systeminfo tool displays a lot of interesting information about the computer and the operating system, among them the installation date. Here is some sample output:
1
2
3
4
5
6
7
8
9
|
Host Name: WIN7 OS Name: Microsoft Windows 7 Enterprise OS Version: 6.1.7600 N/A Build 7600 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Multiprocessor Free Original Install Date: 9/17/2009, 3:58:54 PM <<== System Boot Time: 9/24/2009, 10:34:34 AM ... |
WMI
The install date is stored in the property InstallDate of the WMI class Win32_OperatingSystem. Without conversion, we would get a string like “20090917155854.000000+120”.
PS C:\> ([WMI]”).ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).InstallDate)
Thursday, September 17, 2009 3:58:54 PM
Registry
The install date is stored in the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate as UNIX time (32-bit value containing the number of seconds since 1/1/1970).
PS C:\> [timezone]::CurrentTimeZone.ToLocalTime(([datetime]’1/1/1970′).AddSeconds($(get-itemproperty ‘HKLM:\Software\Microsoft\Windows NT\CurrentVersion’).InstallDate))
Thursday, September 17, 2009 3:58:54 PM
What does not work
I first came up with the idea of querying the creation time of the Windows folder. This does not work because, beginning with Vista, the setup process is image-based. The only thing we can learn from querying the creation date of the Windows folder is when the installation image was created by Microsoft.
PS C:\> (Get-Item “$env:windir”).creationtime
Tuesday, July 14, 2009 4:37:05 AM
My second idea was to use the creation date of a file or folder created right after setup. Here is how I looked for a likely candidate:
1
2
3
4
5
6
7
8
9
10
11
|
PS C:\> gci c: -force | where {$_.creationtime -lt "09.19.2009" -and $_.creationtime -gt "09.16.2009" } | select fullname,creationtime | sort creationtime FullName CreationTime -------- ------------ C:\Recovery 9/17/2009 3:58:50 PM C:\temp 9/17/2009 10:02:46 PM C:\System Volume Information 9/18/2009 12:43:30 AM C:\hiberfil.sys 9/18/2009 12:43:30 AM C:\pagefile.sys 9/18/2009 12:43:32 AM |
Of these results, only the folder “Recovery” is pretty much identical to the “official” install date as recorded by Windows. But using such a method seems way too fragile for production use. Another failed attempt is to use the date of the oldest event log entry as can be seen from the following screen shot: