This command generates the following results:
PS H:\> Get-ADUser JohnD -Properties LastLogonTimeStamp | select Name,LastLogonTimeStamp | fl
Name : John Doe
LastLogonTimeStamp : 130364862459391289
If you are wondering how to parse the 18 digit number of LastLogonTimeStamp property value. This LastLogonTimeStamp is expressed using Windows File Time.
A Windows file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC). Windows uses a file time to record when an application creates, accesses, or writes to a file. More info at HERE.
To convert to human readable date format, use .Net function FromFileTime and convert the output to [DateTime] format.
e.g.,
$u = Get-ADUser JohnD -Properties LastLogonTimeStamp
[DateTime]::FromFileTime([Int64] $u.LastLogonTimeStamp)
Displayed output: 02/09/2014 22:10:45
I wrote the following script to list all of my domain computers with OS and LastLogonTimeStamp vaule. This script also creates a TAB delimited output in text file.
Import-Module ActiveDirectory
$computers = Get-ADComputer -Filter * -Properties name,operatingsystem,lastlogontimestamp -ResultPageSize 0
"Computer Name`tOperating System`tLast Logon Date/Time" | Out-File -FilePath .\DomainComputers.txt
foreach ($computer in $computers)
{
$computer.name + "`t" + $computer.OperatingSystem + "`t" + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp)
$computer.name + "`t" + $computer.OperatingSystem + "`t" + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp) | Out-File -FilePath .\DomainComputers.txt -Append
}
No comments:
Post a Comment