Security Basics mailing list archives

RE: Checking when the OS was first installed


From: "Nobody Special" <harmless () owbn org>
Date: Thu, 26 May 2005 14:29:52 -0500 (CDT)

<quote who="Andrew Aris">
From a cmd prompt rum "systeminfo" and it will display the orignal OS
install date. Not sure how easy this information is to tamper with if that
is a worry.
----------------

Very easy since it pulls the value from the registry key you mention below.

----------------
There is also a registry key in
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\

Although this is a DWORD so its not exactly human-friendly!

cheers,

Andrew


Current thread: