Group: microsoft.public.windowsxp.security_admin
From: =?Utf-8?B?Vmluc29u?=
Date: Tuesday, October 30, 2007 6:37 AM
Subject: RE: Determine when a Windows XP user account has been disabled

How about with scripting? The script below is a WMI script that should do
the trick. Just cut the script below, and past into into notepad. Save the
file as something like: expiredate.vbs

Then double-click on the file to run it.

' // Begin Script - Cut from line below

On Error Resume Next

Set objAccounts = GetObject("WinNT://.")
objAccounts.Filter = Array("User")

For Each objUser In objAccounts
If IsNull(objUser.AccountExpirationDate) Then
Wscript.Echo objUser.Name, "Account has no

expiration date."
Else
Wscript.Echo objUser.Name,

objUser.AccountExpirationDate
End If
Next

' // End Script - Cut to line above


Vinson

"Frank I." wrote:

> Hi all,
>
> I have the following question regarding Windows XP:
>
> Is it possible to determine the date (and evtl. time) when a user account
> has been disabled/locked?
>
> The account is a local user account and the machine is not part of a domain.
> It is Windows XP Pro with SP2 and the latest hotfixes applied and the
> auditing of "account modification" is disabled (as it is by default in
> Windows). Only logon/logoff is being audited.
>
> Is there any way to get this information?
>
> Thanks for every help or suggestion.
> Frank