What can cause Windows InstallDate to change?

Question

I was wondering if there is anything that can cause the Windows Install Date to change - specifically InstallDate from the Win32_OperatingSystem class. We are using the ManagementObjectSearcher in C# to get various system information for licencing purposes, and on some computers, the windows install date has changed for no apparent reason.

I have been trying to find out exactly where it gets the information for the install date from in order to work out if installing a new service pack or version of .net might cause this, but to no avail.

Unfortunately we can't even see what it has changed from and to because the information is hashed (well, we might get to see what it has changed to, but we would have to bother the customer again).

I guess the other thing that might have happened is that the conversion of the date-time from one format to another might have changed for some reason, but I can't get my head around it to work out if it might. This is what we are doing:

ManagementObjectSearcher searcher = new ManagementObjectSearcher("SELECT * FROM Win32_OperatingSystem");
foreach (ManagementObject wmi_Windows in searcher.Get())
{                   
  try
  {
    s = wmi_Windows["InstallDate"].ToString();
    DateTime dc = ToDateTime(s);
    WindowsInfo.InstallDate = dc.AddTicks(-TimeZone.CurrentTimeZone.GetUtcOffset(DateTime.Now).Ticks).ToLocalTime().ToString();
     break;
   }
   catch (Exception ex)
   {
     //stuff here
   }
 }

Answer 1

The value returned by the property InstallDate of the Win32_OperatingSystem WMI class is retrieved from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate Key, this windows registry value is stored as the number of seconds since January 1, 1970. if you modify that windows registry value and then run the WMI Query again you will get the value modified.