Find out if a local or Microsoft account was used for Win10 install?  

You might be able to find out by checking when account passwords were set up.
Naturally, any subsequent password changes would foil this attempt.

1.1 Run this command to list user accounts

Code:

net user

1.2 then run these on any user accounts created by users

Code:

net user EachUserNameInTurn

omitting the system accounts - Administrator, DefaultAccount, defaultuser0/1/NNN, Guest, WDAGUtilityAccount
1.3 Compare their Password last set entries.

2 Then compare the results to the original installation date in the list produced by the PS command

Code:

Get-ChildItem -Path HKLM:\System\Setup\Source* | ForEach-Object {Get-ItemProperty -Path Registry::$_} | Select-Object ProductName, ReleaseID, CurrentBuild, @{n="Install Date"; e={([DateTime]'1/1/1970').AddSeconds($_.InstallDate)}} | Sort-Object "Install Date"

(Taken from Option 4 of Find Windows 10 Original Install Date and Time [Option 4] - TenForumsTutorials]

3.1 If the oldest password was set at the time of the original installation then you have a definite answer.
3.2 If none of them match then you haven't got an answer.

By the way, why does it matter which type of account was used?


Best of luck,
Denis

You might also be able to compare the Date created properties of each user's
C:\Users\USERNAME\Contacts
folder.

Code:

dir C:\Users\USERNAME /T:C

That would actually be reporting when each user logged in for the very first time. The first login would have been by the account used during installation.
I have never used my Contacts folder and I do not know if any subsequent events might corrupt this comparison.

Using an Admin cmd window for this is slightly more convenient because you can run through getting the results for each username in turn.
The results still need to be compared to the PS output in my para 2 above.


Denis

Try3 said:

You might also be able to compare the Date created properties of each user's
C:\Users\USERNAME\Contacts
folder.

Code:

dir C:\Users\USERNAME\Contacts /T:C

That would actually be reporting when each user logged in for the very first time. The first login would have been by the account used during installation.
I have never used my Contacts folder and I do not know if any subsequent events might corrupt this comparison.

That seems a pretty reliable way of determining the original install date.

My Windows 11 machine reports my Contacts folder was created in 2014. That would be the date I did a Factory Reset on the OEM Windows 7 on the PC this OS came from. That PC got the W10 free upgrade in 2015, and the OS was subsequently moved to a new machine to be eligible for the W10 to W11 upgrade.

And I've just corrected my last post so it's checking the folder rather than its contents

Code:

>dir C:\Users\Denis /T:C
 ...
09/12/2016  12:41    <DIR>          Contacts

All the best,
Denis

From RickC post, can I conclude that if C:\Users\Name I see an account name showing an email address then it's an MSA (Microsoft Account)?

Luiz,

C:\Users\UserName itself will not be an email address.

Denis

Try3 said:

Luiz,

C:\Users\UserName itself will not be an email address.

Denis

My Win 10 account is local but I read that users who has MS account has a C:\Users\UserName that is different from what is the login name.

Luiz,

Yes. If a user account is created as an MSAccount-linked user account then its C:\users\%userName% folder will, by default, be the first 5 characters of the MSAccount name / email address before the @ sign.

Denis