Wednesday, February 12, 2014

LastLogonTimeStamp: How to parse the 18 digit number in PowerShell?

This command generates the following results:

PS H:\> Get-ADUser JohnD -Properties LastLogonTimeStamp | select Name,LastLogonTimeStamp | fl

Name               : John Doe
LastLogonTimeStamp : 130364862459391289

If you are wondering how to parse the 18 digit number of LastLogonTimeStamp property value. This LastLogonTimeStamp is expressed using Windows File Time.

A Windows file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC). Windows uses a file time to record when an application creates, accesses, or writes to a file. More info at HERE.

To convert to human readable date format, use .Net function FromFileTime and convert the output to [DateTime] format.

e.g., 

$u = Get-ADUser JohnD -Properties LastLogonTimeStamp

[DateTime]::FromFileTime([Int64] $u.LastLogonTimeStamp)

Displayed output: 02/09/2014 22:10:45

I wrote the following script to list all of my domain computers with OS and LastLogonTimeStamp vaule. This script also creates a TAB delimited output in text file.

 

Import-Module ActiveDirectory

$computers = Get-ADComputer -Filter * -Properties name,operatingsystem,lastlogontimestamp -ResultPageSize 0
"Computer Name`tOperating System`tLast Logon Date/Time" | Out-File -FilePath .\DomainComputers.txt
foreach ($computer in $computers)
{
   $computer.name + "`t" + $computer.OperatingSystem + "`t" + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp)
    $computer.name + "`t" + $computer.OperatingSystem + "`t" + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp) | Out-File -FilePath .\DomainComputers.txt -Append
}

No comments:

Post a Comment

Followers

hit counter