This is information that many customers have been asking for (including myself) and I am super happy to share it with all.

Sometimes during security auditing we require to provide VM creation information to security team to get successful audit.

Here are a few things to be aware of regarding the createDate behavior:

  • VM creation date is available using the vSphere API
  • You will need to install PowerCLI 10.1.0

How to get the VM Creation date along with the user who created it: Below is the elegant way to create a function/script that you need to copy and paste into PowerCLI

======================
function Get-VMCreationTime {
$vms = get-vm
$vmevts = @()
$vmevt = new-object PSObject
foreach ($vm in $vms) {
#Progress bar:
$foundString = ” Found: “+$vmevt.name+” “+$vmevt.createdTime+” “+$vmevt.IPAddress+” “+$vmevt.createdBy
$searchString = “Searching: “+$vm.name
$percentComplete = $vmevts.count / $vms.count * 100
write-progress -activity $foundString -status $searchString -percentcomplete $percentComplete

$evt = get-vievent $vm | sort createdTime | select -first 1
$vmevt = new-object PSObject
$vmevt | add-member -type NoteProperty -Name createdTime -Value $evt.createdTime
$vmevt | add-member -type NoteProperty -Name name -Value $vm.name
$vmevt | add-member -type NoteProperty -Name IPAddress -Value $vm.Guest.IPAddress
$vmevt | add-member -type NoteProperty -Name createdBy -Value $evt.UserName
#uncomment the following lines to retrieve the datastore(s) that each VM is stored on
#$datastore = get-datastore -VM $vm
#$datastore = $vm.HardDisks[0].Filename | sed ‘s/\[\(.*\)\].*/\1/’ #faster than get-datastore
#$vmevt | add-member -type NoteProperty -Name Datastore -Value $datastore
$vmevts += $vmevt
#$vmevt #uncomment this to print out results line by line
}
$vmevts | sort createdTime
}
======================

  • Now connect to vCenter server by using Connect-VI server command.
    Connect-VIServer -Server -User -Password <>
  • Run below command, which will give the output all the VM’s creation details (Creation time, VM Name, IP address, User who created the VM) :
    Get-VM | Get-VMcreationTime