How to find the Windows installation date

The installation date of the operating system is a useful data point in an investigation: it tells you since when a system has been in use and helps you put other artifacts in context. There are several ways to find it; these are the ones I use most.

Note: on Windows 10 and 11, feature updates (such as the Creators Update) reinstall the operating system, so the first three methods usually return the date of the last feature update rather than the original installation. Methods 4 and 5 get you closer to the original date.

1. Registry, with PowerShell

The installation date is stored in the InstallDate value of this registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

The value is Unix time, the number of seconds since 1 January 1970 (UTC). To read it and convert it to a human-readable date (in local time) in PowerShell:

$date = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' | Select-Object -ExpandProperty InstallDate
(Get-Date "1970-01-01 00:00:00.000Z") + ([TimeSpan]::FromSeconds($date))

On a forensic image, you’ll find the same value in the SOFTWARE hive (Windows\System32\config\SOFTWARE), which you can open with any registry viewer.

Requires: PowerShell · OS: Windows 7 and later

2. systeminfo, from the command prompt

systeminfo displays the configuration of a computer and its operating system, including the original install date. Open a command prompt and run:

systeminfo | find /i "original"

This search string only works if Windows is in English. In other languages the “Original Install Date” label is translated, so search for the localized label instead.

Requires: cmd · OS: Windows XP and later

3. WMI, with PowerShell

You can also get the date from WMI (Windows Management Instrumentation):

([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).InstallDate)

Get-WmiObject is not available in PowerShell 7. There, use the CIM cmdlet, which already returns a readable date:

(Get-CimInstance Win32_OperatingSystem).InstallDate

Requires: PowerShell · OS: Windows 7 and later

4. Client-side cache folder (Windows 10)

A good way to get close to the original installation date on Windows 10 is to look at the last write time of the client-side cache folder:

Get-Item C:\Windows\CSC\ | Select-Object LastWriteTime

Its LastWriteTime is one of the closest things to the original installation date of the system. See also this discussion.

Requires: PowerShell · OS: Windows 10

5. Previous installations in the registry (Windows 10 and 11)

Every feature update keeps the details of the previous installation in a key named HKLM\SYSTEM\Setup\Source OS (Updated on …), including its InstallDate. Listing these keys gives you the history of the upgrades, and the oldest one points to the original installation:

Get-ChildItem 'HKLM:\SYSTEM\Setup' | Where-Object PSChildName -like 'Source OS*' | ForEach-Object { [DateTimeOffset]::FromUnixTimeSeconds((Get-ItemProperty $_.PSPath).InstallDate).UtcDateTime }

Requires: PowerShell · OS: Windows 10 and later

Do you use other methods to find the installation date? Share them in the comments.

Updated in October 2026 with the CIM cmdlet and the Source OS registry keys.