Saturday, December 15, 2007

OS Install date

 

Yesterday, I had to query some computers for the date/time the OS was installed. I remembered that there is a registry key for that so I checked the registry under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
-or-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

 

Nope, no sign for it, it wasn't there. I found it under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

The key is named InstallDate but its value was a number that didn't resemble any date time format.

 

installdate

 

 

 

 

 

 

 

 

 

According to Microsoft,  this value represents a time/date as an offset in seconds from
midnight, January 1, 1970. Hmm... no problem, I can use the AddSeconds() method of the [datetime] type to return the exact OS install date:

 

### EDIT 12/23/2007 ###

Thanks to TRB86 for pointing me to initialize the hour/minute/second parameters.
If you won't define those parameters (which I thought will default to zero, respectively) you'll end up with the correct date but with your local time values.
So, if you're local time is  10:23:11, then doing so will initialize $date to 01/01/1970 10:23:11

$date = get-date -year 1970 -month 1 -day 1
$date -format "MM/dd/yyyy HH:mm:ss"
01/01/1970 10:23:11

#####################

 

PS > $path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
PS > $id = get-itemproperty -path $path -name InstallDate
PS > $d = get-date -year 1970 -month 1 -day 1 -hour 0 -minute 0 -second 0
## the following returns the datetime -2 hours which is my GMT offset (+02:00).
## $d.AddSeconds($id.InstallDate) -f "MM/dd/yyyy"
## 02/28/2007 23:56:23

## add to hours (GMT offset)
PS > ($d.AddSeconds($id.InstallDate)).ToLocalTime().AddHours(2) -f "MM/dd/yyyy"

03/01/2007 01:56:23

 

## to get the timezone offset programatically:
## get-date -f zz

PS > ($d.AddSeconds($id.InstallDate)).ToLocalTime().AddHours((get-date -f zz)) -f "MM/dd/yyyy"

03/01/2007 01:56:23

 

 

 

The same can be achieved with WMI :

PS > $os = get-wmiobject win32_operatingsystem
PS > $os.ConvertToDateTime($os.InstallDate) -f "MM/dd/yyyy"

03/01/2007 01:56:23

2 comments:

TRB86 said...

Should you not use -hour 0 -min 0 -sec 0 (when you do the get-date), otherwise you will use the current time on Jan 1, rather than midnight. This may also be why you see a 18 min difference when using WMI.

$hay@Israel said...

Thanks! I updated the post.