4
How can I tell if a user's Windows operating system was updated from previous version of Windows, or his current Windows version is the originally installed version? E.g., how can I tell if his Windows 8.1 is updated from Windows 8 (or older)?
4
How can I tell if a user's Windows operating system was updated from previous version of Windows, or his current Windows version is the originally installed version? E.g., how can I tell if his Windows 8.1 is updated from Windows 8 (or older)?
2
If windows was upgraded from a previous version, you should have Windows.old folder, it sometimes gets removed, if you run Disk Cleanup.
File C:\Windows.old\System32\license.rtf will tell you exactly which version was installed before the upgrade to Windows 8.1.
EDIT: It seems that with WIndows 8.1 Windows.old folder gets removed 28 days after the upgrade automatically.
Another option would be to find the oldest Windows Error Reporting information in Event Viewer.
http://windows.microsoft.com/en-us/windows/what-information-event-logs-event-viewer#1TC=windows-7
Depending on application reported in it it will have something like this.
svchost.exe_netsvcs
6.3.9600.16384
6.3.9600.2.0.0
or this
Microsoft.SkypeApp_2.0.0.5011_x86__kzf8qxf38zg5c
praid:App
6.3.9600.16384
or this
HostProblem
HostTimeout
2
6.3.9600.16384. (winblue_rtm.130821-1623)
6.3 is Windows 8.1, check Event Viewer for this kind of type, starting from the oldest one, and see what versions will be reported there.
When you open Even Viewer, go to Windows Logs > Application. Click on Filter Current Log on right side and Filter only Event level: Information, and Event Sources Windows Error Reporting, and then sort them by date, to find the oldest one.
You can also try to filter by Event Sources: Kernel-General, and see what is the oldest one that contains version reported in Event Data, and see what MajorVersion, and MinorVersion values are.
See here for Windows version release numbers
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724832%28v=vs.85%29.aspx
Ok so this folder gets removed after 28 days or when user runs cleanup. Got any more reliable method? – gadelat – 2014-10-27T11:41:54.847
check event viewer as described above, events can also get overwritten or cleared, in some cases – rAlen – 2014-10-27T12:11:29.623
The error reporting log appears to get truncated as well. My oldest event there is from about 10 months ago, on an install that's several years old. – Dan is Fiddling by Firelight – 2014-10-27T13:24:34.620
If there is a
Windows.old
folder on aWindows 8.1
system then it was upgraded from a previous version other thanWindows 8
. – Ramhound – 2014-10-27T09:53:22.443