How to get the date when your credentials were changed on PowerShell?

Question

When you connect to the Outlook account, a 'MicrosoftOffice16_Data:SSPI:[email protected]' entry is created in the credential manager. How can I get the modification date of this record in Powershell?

Answer 1

• You can install the BetterCredentials module from the PowerShell Gallery, e.g. with:

  Install-Module BetterCredentials -AllowClobber
  

• Then use its Find-Credential command to locate the credentials of interest and examine the .LastWriteTime property:

  Find-Credential | 
    Where-Object Target -like *:*=MicrosoftOffice16_Data:SSPI:[email protected] |
    ForEach-Object LastWriteTime
  

  • You may have to tweak the wildcard pattern passed to the -like operator to find the desired credentials.

  • Note that while Find-Credential itself has a -Filter parameter, the patterns it supports are very limited (only a single *, and only on either end of the pattern) and even then they don't seem to work reliably (as of v4.5 of the module).