I was about to give you a POC PowerShell script to extract and parse out the creation time, but I realized that chntpw
's logic is incorrect. The value it calls the creation time is actually the password last set time, although these values are the same upon the initial account creation. See here for an exhaustive description of the SAM.
Evan's second link, for samparse
, might get it right though. Looking at its actually does work. If you look at its source here, line 99:
$c_date = $create->get_timestamp();
you'll see it calls get_timestamp
from Perl's Parse::Win32Registry
. I'm pretty sure that is actually the last write time of the key. Since it appears that particular key (HKLM\SAM\SAM\Domains\Account\Users\Names\<USERNAME>
) only holds a pointer to the corresponding RID key, it shouldn't change after creation and the last write time will be equal to the creation time.
I you want to stick with more built-in tools, here is a series of Scripting Guy articles explaining how via PowerShell:
Use PowerShell to Access Registry Last-Modified Time Stamp
Reusing PowerShell Registry Time Stamp Code
Create a Proxy Function to Display Registry Key Time Stamps
Leverage Registry Key Time Stamps via PowerShell