(imported topic written by BobbyElmore)
I’m trying to figure out the best way to get the windows operating system original installation date. I was able to retrieve this via WMI but as you can see below the result isn’t ideal:
q: selects “InstallDate from Win32_OperatingSystem” of wmi
A: InstallDate=20130327100221.000000-240
how can I parse this line to output the date (and time)of this property in a format like “03/27/2013 10:02:21 AM”
or alternatively, is there a better way to go about getting this information in the first place? Thanks in advance!
(imported comment written by nberger91)
q: if (name of operating system does not contain “Win”) then “N/A” else if (exists wmi AND exists selects “InstallDate from win32_operatingsystem” of wmi AND not ((string value of selects “InstallDate from win32_operatingsystem” of wmi) = “”)) then ((first 4 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi))) & “-” & (first 2 of (last 4 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi)))) & “-” & (last 2 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi)))) else (“N/A”)
A:2013-01-04
T:45.657 ms
(imported comment written by vpetrell)
You have a couple of options for this. I ran the one above option, along with two other options on my PC to compare the time they took to process and the format of the output.
q: if (name of operating system does not contain “Win”) then “N/A” else if (exists wmi AND exists selects “InstallDate from win32_operatingsystem” of wmi AND not ((string value of selects “InstallDate from win32_operatingsystem” of wmi) = “”)) then ((first 4 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi))) & “-” & (first 2 of (last 4 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi)))) & “-” & (last 2 of (first 8 of string value of (selects “InstallDate from Win32_OperatingSystem” of wmi)))) else (“N/A”)
A: 2011-05-27
T: 58.202 ms
q:if (exist wmi) then (first 11 of following text of position 5 of (time value of select (“InstallDate from Win32_OperatingSystem”) of wmi as string)) else (“N/A”)
A: 27 May 2011
T: 10.620 ms
q:if (exist wmi) then (time value of select (“InstallDate from Win32_OperatingSystem”) of wmi as string) else (“N/A”)
A: Fri, 27 May 2011 14:23:52 -0400
T: 15.371 ms
(imported comment written by ycardina)
A little more efficient and includes time
q: if (name of operating system does not contain “Win”) then “N/A” else if (exists wmi AND exists selects “InstallDate from win32_operatingsystem” of wmi AND not ((string value of selects “InstallDate from win32_operatingsystem” of wmi) = “”)) then ((first 2 of following text of position 4 of it & “-” & first 2 of following text of position 6 of it & “-” & first 4 of it & " " & first 2 of following text of position 8 of it & “:” & first 2 of following text of position 10 of it & “:” & first 2 of following text of position 12 of it) of string value of select (“InstallDate from Win32_OperatingSystem”) of wmi as string) else (“N/A”)
A: 05-02-2012 13:46:14
T: 25.098 ms
(imported comment written by jgstew)
http://bigfix.me/cdb/relevance/1557
(value “InstallDate” of key “HKLM\Software\Microsoft\Windows NT\CurrentVersion” of native registry) as string as integer * second + “01 Jan 1970 00:00:00” as local time
1 Like
(imported comment written by jgstew)
I prefer to find info in the registry if possible, typically much more efficient than WMI