登录历史和操作系统安装日期

Question

实际上，我想在购买笔记本电脑之前先知道Windows操作系统的安装日期。 以及在我购买之前，卖方进行的登录的日期和时间。

Answer 1

登录日期存储在事件日志中。 因此，您可以使用wevtutil查询事件：

wevtutil qe Security /q:"*[System/EventID=4624] and *[System/Task=12544] and *[EventData/Data[@Name='LogonType']=5]" /e:Events /f:Text | find "Date:"

对于安装日期，您可以使用：

WMIC OS GET InstallDate /format:value

Answer 2

使用Powershell获得所需的数据：

$date = Get-Date -Date 26.04.2016 #date when you bought your laptop
$wmi = Get-WmiObject -Class Win32_OperatingSystem
$logons = Get-EventLog -LogName Security -EntryType SuccessAudit -InstanceId 4624 -Before $date
@{InstallDate=$wmi.ConvertToDateTime($wmi.InstallDate);LogonsCount=$logons.count}

确保最近未清除您的安全日志以获取正确的值。

Answer 3

尝试使用具有转换日期的此批处理代码：

@echo off
Color 9B & Mode con cols=60 lines=3
Title The Install Date of your OS by Hackoo 2016
for /f "delims=" %%A in ('WMIC OS GET InstallDate /format:value') do (
    @for /f "tokens=2 delims==" %%B in ("%%A") do (
        Call :ConvertDate %%B
    )>"%~n0.txt"
)

for /f "delims=" %%D in ('Type "%~n0.txt"') do ( set InstallDate=%%D )
echo(
echo    The Install Date of your OS is : %InstallDate%
pause>nul
Exit /b
::**********************************************************************
Rem Function for Converting WMI Dates to a Standard Date-Time Format
:ConvertDate <Date>
(
    echo WScript.echo WMIDateStringToDate("%~1"^)
    echo Function WMIDateStringToDate(Mydate^)
    echo  WMIDateStringToDate = CDate(Mid(Mydate, 5, 2^) ^& "/" ^& _
    echo  Mid(Mydate, 7, 2^) ^& "/" ^& Left(Mydate, 4^) _
    echo  ^& " " ^& Mid (Mydate, 9, 2^) ^& ":" ^& _
    echo  Mid(Mydate, 11, 2^) ^& ":" ^& Mid(Mydate,13, 2^)^)
    echo End Function
)>"%~n0.vbs"
cscript /nologo "%~n0.vbs" "%~1"
Del "%~n0.vbs"
exit /b
::**********************************************************************