0

This question came up while I was investigating a server that randomly restarted last night. I was looking through the event logs to see if someone manually restarted the system, but nothing was identified.

I went to C:\Users and there wasn't a single profile that had a modify date in a couple of years. When went to User Profiles by way of the System Properties window, I found that a handful of accounts logged in as recently as today. Those same names match to C:\Users, but the modify dates do not match. Why is this?

AKDiscer
  • 123
  • 2
  • 11

1 Answers1

2

Because the modification date of the profile folder is completely separate from the modification date of the files inside it, and the modification date of the profile folder doesn't necessarily have any correlation with the modification of the user's actual profile.

Determining the user profile modified date is done differntly, depending on which version of Windows you have.

On Windows 2000, XP and Server 2003, this is done by checking the modified date on the NTUSER.DAT file inside each specific user's root folder. As your comment below indicates, this is not especially accurate, as that file can be modified by system processes, services, etc, and may not be a good indication of when the user last logged in.

Under Server 2008/Vista and up, it's done with WMI, specifically the LastUseTime property of the Win32_UserProfile class. That would be where the System Properties window gets the information from, and you can do it too, through a command line. Again, this is because the modification date of the user profile folder is not necessarily correlated at all with modifications to the user profile itself. I could, for example rename a user's profile folder, change the date stamp, and so on, without actually making any changes to the profile itself, and likewise, I could modify the profile without changing a thing about the folder it's in.

And of course, this is a query you can run manually yourself. In PowerShell for example, it would look like:

gwmi win32_userprofile

enter image description here

That will list all the user profiles on the machine and include all the attributes. If you only care about, say the LastUseTime, then you'd do:

gwmi win32_userprofile | select localpath, lastusetime

enter image description here

Lists all the user profiles, but only the local path (so you can determine which user which profile belongs to) and the attribute you're interested in.

HopelessN00b
  • 53,795
  • 33
  • 135
  • 209
  • I just reviewed the NTUSER.DAT and ALL of them were modified today. A few of those profiles are associated with employees that haven't been here in years. The server was restarted at 11:49pm last night and all NTUSER.DAT modification dates are 41 minutes later. – AKDiscer Jun 05 '14 at 15:56
  • @SeanPerkins Sorry, I could swear that was [tag:Windows-Server-2003-R2]. Updated with the Windows Server 2008/Vista+ method. – HopelessN00b Jun 05 '14 at 18:26
  • That worked, thank you for you time. What data is this information being pulled from on this command? – AKDiscer Jun 10 '14 at 16:47
  • @SeanPerkins This command is directly querying the class where Windows stores user profile information, including "LastUseTime," (which you'd think should be *really* close to the last time that user was logged in) but that's as much as know. I think you'd have to get it from an MS coder if you wanted more detail than that. – HopelessN00b Jun 10 '14 at 18:07