使用 PowerShell，我可以找到用户帐户的创建时间吗? [英] Using PowerShell, can I find when a user account was created?

问题描述

这是一个简单的问题.我知道信息在某处.我已经用 Powershell 锤炼了 3 天并接近了.老实说，我没时间了.

It's a simple question. I know the information is there somewhere. I've been hammering away with Powershell for 3 days and getting close. I'm runnin' out of time to be honest.

情况是这样的.人员进入并在本地计算机(Windows 7)上创建一个帐户.我如何找到创建帐户的时间.我理解在配置文件中查找 NTUSER.DATE 日期，但这并不完全有效.我得到的信息全部分布在 csv 中，而且没有简单的方法让它可读.

Here's the situation. Person goes in and creates an account on a local machine (windows 7). How do I find when the account was created. I understand looking NTUSER.DATE dates in the profile, but that doesn't quite work. I get information all spread out in the csv and no easy way to get it readable.

Get-Item  -force "C:\Users\*\ntuser.dat" |
 Where {((Get-Date)-$_.lastwritetime).days } | 
 Out-File c:\profiles.csv

可以看到安全日志中的信息，可以拉取所有4720个事件.然而，这也是不一致的，特别是如果几个月前一些无赖(像我一样)清除了事件日志.

I can see the information in the security log, and I can pull all 4720 events. However, that too is inconsistent, especially if some rascal (like me) cleared out the event log a couple of months ago.

Get-EventLog -LogName Security | Where-Object { $_.EventID -eq 4720 } |
 EXPORT-CSV C:\NewStaff.csv

但这也不能真正满足我的需求.我只需要用户名和创建帐户的日期.我知道这不是那么简单(虽然它应该是 LOL).这是一份一次性的工作，我对 Powershell 很在行(尽管过去几天我学到了很多东西).

But that doesn't really get me what I need either. All I need is the username and the date the account was created. I know it's not that simple (although it should be LOL). It's a one time job and I suck at Powershell (although, I've learned a lot over the past couple of days).

无论如何，如果有人不介意扔给我一块骨头，我会很感激的.感谢您的关注.

Anyway, if someone wouldn't mind throwing me a bone, I'd appreciate it. Thanks for looking.

推荐答案

你们确实很亲近.您现在需要的只是格式化.示例:

You are indeed very close. All you need now is formatting. Example:

Get-EventLog -LogName "Security" | Where-Object { $_.EventID -eq 4720 } `
    | Select-Object -Property `
        @{Label="LogonName";Expression={$_.ReplacementStrings[0]}}, `
        @{Label="CreationTime";Expression={$_.TimeGenerated}} `
    | Export-Csv C:\NewStaff.csv -NoTypeInformation 

这篇关于使用 PowerShell，我可以找到用户帐户的创建时间吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！