Christian,
Unfortunately this is not tracked in the NT 4.0 SAM. You can however get
the sequence order ('user_id') in which the account was created and perhaps
back figure it. Here is a piece of code I use to dump User Accounts.
use Win32::Lanman;
Win32::Lanman::NetGetDCName( $ENV{'LOGONSERVER'}, $ENV{'USERDOMAIN'},
\$PDC);
Win32::Lanman::NetUserEnum($PDC, 0, \@accounts);
print "Auth Flags\tAcct Expires\tBad Pw Count\tCode Page\tComment\tCountry
Code\tFlags\tFull Name\t";
print "Home Dir\tHome Dir Drive\tLast Logoff\tLast Logon\tLogon Hours\tLogon
Server\tMax Storage\tName\t";
print "Num Logons\tPassword Age\tPassword Expired\tPrimary Group
Id\tPriv\tProfile\tScript Path\t";
print "Units Per Week\tUser Id\tUsr Comment\tWorkstations\tRights\n";
foreach $account (@accounts) {
if ( substr(${$account}{'name'},-1,1) eq '$'){next}; #Skip Trust and
WKS Accounts
@lmdate = localtime(${$account}{'last_logon'});
$last_logon = sprintf "%02d/%02d/%04d %02d:%02d:%02d",
(@lmdate[4]+1),(@lmdate[3]),(@lmdate[5]+1900),(@lmdate[2]),(@lmdate[1]),(@lm
date[0]);
@lmdate = localtime(${$account}{'last_logoff'});
$last_logoff = sprintf "%02d/%02d/%04d %02d:%02d:%02d",
(@lmdate[4]+1),(@lmdate[3]),(@lmdate[5]+1900),(@lmdate[2]),(@lmdate[1]),(@lm
date[0]);
@lmdate = localtime(time - ${$account}{'password_age'});
$password_age = sprintf "%02d/%02d/%04d %02d:%02d:%02d",
(@lmdate[4]+1),(@lmdate[3]),(@lmdate[5]+1900),(@lmdate[2]),(@lmdate[1]),(@lm
date[0]);
if (${$account}{'acct_expires'} > 0 ){
@lmdate =
localtime(${$account}{'acct_expires'}{'password_age'});
$acct_expires = sprintf "%02d/%02d/%04d %02d:%02d:%02d",
(@lmdate[4]+1),(@lmdate[3]),(@lmdate[5]+1900),(@lmdate[2]),(@lmdate[1]),(@lm
date[0]);
} else { $acct_expires = "" };
if (${$account}{'auth_flags'} & 0x10 ){ $Rights = "Administrator " }
else {$Rights = ""};
if (${$account}{'auth_flags'} & 0x08 ){ $Rights = $Rights."Account
Op " };
if (${$account}{'auth_flags'} & 0x04 ){ $Rights = $Rights."Server Op
" };
if (${$account}{'auth_flags'} & 0x02 ){ $Rights = $Rights."Comm Op "
};
if (${$account}{'auth_flags'} & 0x01 ){ $Rights = $Rights."Print Op
" };
print
"${$account}{'auth_flags'}\t$acct_expires\t${$account}{'bad_pw_count'}\t${$a
ccount}{'code_page'}\t";
print
"${$account}{'comment'}\t${$account}{'country_code'}\t${$account}{'flags'}\t
${$account}{'full_name'}\t";
print
"${$account}{'home_dir'}\t${$account}{'home_dir_drive'}\t$last_logoff\t$last
_logon\t${$account}{'logon_hours'}\t";
print
"${$account}{'logon_server'}\t${$account}{'max_storage'}\t${$account}{'name'
}\t${$account}{'num_logons'}\t";
print
"$password_age\t${$account}{'password_expired'}\t${$account}{'primary_group_
id'}\t${$account}{'priv'}\t";
print
"${$account}{'profile'}\t${$account}{'script_path'}\t${$account}{'units_per_
week'}\t${$account}{'user_id'}\t";
print
"${$account}{'usr_comment'}\t${$account}{'workstations'}\t$Rights\n";
}
James
NetUserEnum Documentation
http://msdn.microsoft.com/library/en-us/netmgmt/ntlmapi2_3kx9.asp
>Date: Fri, 25 Jan 2002 12:08:40 +0100
>From: "Christian Jung" <[EMAIL PROTECTED]>
>To: "<"<[EMAIL PROTECTED]>
>Subject: user's creation date
>
>Hi,
>
>is it possible to extract user's creation date from windows NT 4.0 SAM.
>
>In win32::lanman module there is NetUserEnum function witch extract user's
=
>informations, but i don't saw this date.
>
>Have you ever seen this information anywhere ?
>
>thanks
_______________________________________________
Perl-Win32-Admin mailing list
[EMAIL PROTECTED]
http://listserv.ActiveState.com/mailman/listinfo/perl-win32-admin
