windows 7 - Using PowerShell, can I find when a user account was created? -

This is a simple question. I know that information is elsewhere. I'm bumping up to 3 days with PowerShell and close I am here. I'm Runnin 'Honestly Out of Time

Here's the situation the person opens the account in a local machine (Windows 7) and creates the account. How do I create an account? I am looking at the NTUSER.DATE dates in the profile, but it does not work much. I get all the information in CSV and there is no easy way to make it readable.

  go-item-force "c: \ user \ * \ ntuser.dat" | Where {(get-date) - $ _ last light time) .days} | Out-file c: \ profiles.csv  

I can see the information in the security log, and I can drag all 4720 events. However, that is also incompatible, especially if some rascals (like mine) had cleared the event log a few months ago.

  Get-EventLog -LogName Security | Where-object {$ _. EventID -q 4720} | Export-CSV C: \ NewStaff.csv  

But it really is not getting me what I want I need all the username and date account was created. I know that this is not easy (although it should be worth it) It's a job once and I suck on PowerShell (though, I've learned a lot in the last few days).

Anyway, if someone does not feel like throwing a bone, then I would appreciate it. thanks for watching.

You are really very close, now you need all the formatting. Example:

  Gate-event log-log name "security" | Where-object {$ _. EventID-Ik 4720} `` | Select-object-property `@ {label =" login name "; Expression = {$ _. Replacement strings [0]}}, `@ {label =" CreateTime "; Expression = {$ _. Timezone}} `` export-csv c: \ NewStaff.csv -NoTypeInformation