date stamp when accounts disabled?

Hi - Can't answer your question about Registry, would guess that that data isn't stored there. There is probably a security file that has that data, may have a last modified date but I don't know where that is (yet).

If you save event log beforeclearing, you can reload those saved files, or restore from disk if you do backups. Can probably restore backups to another system (work/scratch) to check the log but that is a bit of work.

For future - might consider changing your disable policy to add the disable date to the account description. That way you will have the date no matter what (until it gets reactivated or deleted).