DSQuery get lastlogon date in active directory

Question

I need the lastlogon field of my domain computers exported. I used this command:

dsquery * domainroot -filter "(&(objectCategory=Computer)(
objectClass=User))" -attr distinguishedName sAMAccountName lastLogon

This was exported to txt file, my problem is that the lastlogon field is a integer timestamp and not really a date. For example this is a value: 130931011681543000, but I cannot recognize this values as a date. This is not a unixtimestamp, millis from 1900/1/1... how to convert this values to a readable date?

Answer 1

I found it, it is a FILETIME object and I could convert it using an Excel macro:

Option Explicit

Private Type FILETIME dwLowDateTime As Long dwHighDateTime As Long End Type

Private Type SYSTEMTIME wYear As Integer wMonth As Integer wDayOfWeek As Integer wDay As Integer wHour As Integer wMinute As Integer wSecond As Integer wMilliseconds As Integer End Type

Private Declare Function FileTimeToSystemTime Lib "kernel32" (lpFileTime As FILETIME, lpSystemTime As SYSTEMTIME) As Long

Function ConvertDate(test)
    ConvertDate = Bit64ToDate(test)
    '4/26/2010 8:32:27 PM
End Function

Private Function Bit64ToDate(Bit64) As Date
    Dim High As Long, Low As Long, ft As FILETIME, st As SYSTEMTIME

    GetTwoLongsFromInt64 [Bit64], ft.dwHighDateTime, ft.dwLowDateTime

    FileTimeToSystemTime ft, st
    Bit64ToDate = SystemTimeToVBTime(st)
End Function

'the following function - thanks to
'http://doc.xceedsoft.com/products/Xceedzip/64_bit_values.html
Private Sub GetTwoLongsFromInt64(ByVal cInt64 As Double, ByRef lHigh As Long, ByRef lLow As Long)
    Dim cRemainder As Double

    lHigh = CLng(Fix(cInt64 / 4294967296#))
    cRemainder = cInt64 - (lHigh * 4294967296#)

    If (cRemainder <= 2147483647#) Then
        lLow = CLng(cRemainder)
    Else
        cRemainder = cRemainder - 4294967296#
        lLow = (CLng(cRemainder))
    End If
End Sub

'the following function - thanks to
'http://www.cpearson.com/excel/FileTimes.htm
Private Function SystemTimeToVBTime(SysTime As SYSTEMTIME) As Date
    With SysTime
        SystemTimeToVBTime = DateSerial(.wYear, .wMonth, .wDay) + _
                TimeSerial(.wHour, .wMinute, .wSecond)
    End With
End Function