How do I find the install time and date of Windows?

Viewed 326911

This might sound like a little bit of a crazy question, but how can I find out (hopefully via an API/registry key) the install time and date of Windows?

The best I can come up with so far is to look at various files in C:\Windows and try to guess... but that's not exactly a nice solution.

20 Answers

TLDR

IMPORTANT NOTE if Windows was "installed" using a disk image both methods fail.

Method 1 works if windows haven't been upgraded to a new major version (e.g. Windows 10 to Windows 11). You execute the command systeminfo and look for a line beginning with "Original Install Date" (or something like that in your local language). You can get the same version by querying WMI and by looking at the registry. if windows was upgraded to a new major version this method unfortunately gives you the date of installation of the new major version. Here's an example to check the version by running systeminfo from PowerShell:

systeminfo | sls "original"

Method 2 This seems to work correctly even after a major update. You get the installation date by checking the creation time of the file system.ini which seems to stay untouched. e.g. with PowerShell:

 (Get-Item "C:\Windows\system.ini").CreationTime

Details

Another question eligible for a 'code-challenge': here are some source code executables to answer the problem, but they are not complete. Will you find a VBScript that anyone can execute on his/her computer, with the expected result?


systeminfo|find /i "original"

would give you the actual date... not the number of seconds ;)

But (caveat), as noted in the 2021 comments by Salman A and AutoMattTick

If Windows was updated to a newer version, this seems to give the date on which Windows was RE-installed.


As Sammy comments, find /i "install" gives more than you need. And this only works if the locale is English: It needs to match the language. For Swedish this would be "ursprungligt" and "ursprüngliches" for German.

Andy Gauge proposes in the comments:

shave 5 characters off with

systeminfo|find "Original"

In Windows PowerShell script, you could just type:

PS > $os = get-wmiobject win32_operatingsystem
PS > $os.ConvertToDateTime($os.InstallDate) -f "MM/dd/yyyy"

By using WMI (Windows Management Instrumentation)

If you do not use WMI, you must read then convert the registry value:

PS > $path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
PS > $id = get-itemproperty -path $path -name InstallDate
PS > $d = get-date -year 1970 -month 1 -day 1 -hour 0 -minute 0 -second 0
## add to hours (GMT offset)
## to get the timezone offset programatically:
## get-date -f zz
PS > ($d.AddSeconds($id.InstallDate)).ToLocalTime().AddHours((get-date -f zz)) -f "MM/dd/yyyy"

The rest of this post gives you other ways to access that same information. Pick your poison ;)


In VB.Net that would give something like:

Dim dtmInstallDate As DateTime
Dim oSearcher As New ManagementObjectSearcher("SELECT * FROM Win32_OperatingSystem")
For Each oMgmtObj As ManagementObject In oSearcher.Get
    dtmInstallDate =
        ManagementDateTimeConverter.ToDateTime(CStr(oMgmtO bj("InstallDate")))
Next

In Autoit (a Windows scripting language), that would be:

;Windows Install Date
;
$readreg = RegRead("HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\", "InstallDate")
$sNewDate = _DateAdd( 's',$readreg, "1970/01/01 00:00:00")
MsgBox( 4096, "", "Date: " & $sNewDate )
Exit

In Delphy 7, that would go as:

Function GetInstallDate: String;
Var
  di: longint;
  buf: Array [ 0..3 ] Of byte;
Begin
  Result := 'Unknown';
  With TRegistry.Create Do
  Begin
    RootKey := HKEY_LOCAL_MACHINE;
    LazyWrite := True;
    OpenKey ( '\SOFTWARE\Microsoft\Windows NT\CurrentVersion', False );
    di := readbinarydata ( 'InstallDate', buf, sizeof ( buf ) );
//    Result := DateTimeToStr ( FileDateToDateTime ( buf [ 0 ] + buf [ 1 ] * 256 + buf [ 2 ] * 65535 + buf [ 3 ] * 16777216 ) );
showMessage(inttostr(di));
    Free;
  End;
End;

As an alternative, CoastN proposes in the comments:

As the system.ini-file stays untouched in a typical windows deployment, you can actually get the install-date by using the following oneliner:

(PowerShell): (Get-Item "C:\Windows\system.ini").CreationTime

In regedit.exe go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

It's given as the number of seconds since January 1, 1970. (Note: for Windows 10, this date will be when the last feature update was installed, not the original install date.)

To convert that number into a readable date/time just paste the decimal value in the field "UNIX TimeStamp:" of this Unix Time Conversion online tool.

Windows 10 OS has yet another registry subkey, this one in the SYSTEM hive file:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\

The Install Date information here is the original computer OS install date/time. It also tells you when the update started, ie

 Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on xxxxxx)."

This may of course not be when the update ends, the user may choose to turn off instead of rebooting when prompted, etc...

The update can actually complete on a different day, and

Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\Source OS (Updated on xxxxxx)"

will reflect the date/time it started the update.

I find the creation date of c:\pagefile.sys can be pretty reliable in most cases. It can easily be obtained using this command (assuming Windows is installed on C:):

dir /as /t:c c:\pagefile.sys

The '/as' specifies 'system files', otherwise it will not be found. The '/t:c' sets the time field to display 'creation'.

Determine the Windows Installation Date with WMIC

wmic os get installdate

You can simply check the creation date of Windows Folder (right click on it and check properties) :)

Try this powershell command:

Get-ChildItem -Path HKLM:\System\Setup\Source* | 
 ForEach-Object {Get-ItemProperty -Path Registry::$_} | 
     Select-Object ProductName, ReleaseID, CurrentBuild, @{n="Install Date"; e={([DateTime]'1/1/1970').AddSeconds($_.InstallDate)}} | 
         Sort-Object "Install Date"

After trying a variety of methods, I figured that the NTFS volume creation time of the system volume is probably the best proxy. While there are tools to check this (see this link ) I wanted a method without an additional utility. I settled on the creation date of "C:\System Volume Information" and it seemed to check out in various cases.

One-line of PowerShell to get it is:

([DateTime](Get-Item -Force 'C:\System Volume Information\').CreationTime).ToString('MM/dd/yyyy')

Press WindowsKey + R and enter cmd

In the command window type:

systeminfo | find /i "Original"

(for older versions of windows, type "ORIGINAL" in all capital letters).

You can do this with PowerShell:

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' -Name InstallDate |
    Select-Object -Property @{n='InstallDate';e={[DateTime]::new(1970,1,1,0,0,0,0,'UTC').AddSeconds($_.InstallDate).ToLocalTime()}}
Related