Windows 2003 local ID created date query?

[Guest]

How can I pull the date that local accounts were created on a Windows 20003 server that is not a domain controller?

[cmccullough]

Re: Windows 2003 local ID created date query?

Unfortunately there's no field for local accounts containing the creation date. Active Directory accounts have a WhenCreated field, but not local accounts. You can try the event log on that computer to see if they were logged there.

[UKTonyK]

Re: Windows 2003 local ID created date query?

look for an Event ID 636, with a category of Account Management. That will give you the Member ID created and the User Name of the account that created it as well as Date and Time.

[UKTonyK]

Re: Windows 2003 local ID created date query?

As an addition look for Event ID 630 for local Account deletion.

btw, these are both in the Security log.

[Guest]

Re: Windows 2003 local ID created date query?

Thanks everyone. This forum has always been prompt to respond with excellent information.