LastLogonTimeStamp: How to parse the 18 digit number in PowerShell?


This command generates the following results:

PS H:\> Get-ADUser JohnD -Properties LastLogonTimeStamp | select Name,LastLogonTimeStamp | fl

Name               : John Doe
LastLogonTimeStamp : 130364862459391289

If you are wondering how to parse the 18 digit number of LastLogonTimeStamp property value. This LastLogonTimeStamp is expressed using Windows File Time.

A Windows file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC). Windows uses a file time to record when an application creates, accesses, or writes to a file. More info at HERE.

To convert to human readable date format, use .Net function FromFileTime and convert the output to [DateTime] format.

e.g., 

$u = Get-ADUser JohnD -Properties LastLogonTimeStamp

[DateTime]::FromFileTime([Int64] $u.LastLogonTimeStamp)

Displayed output: 02/09/2014 22:10:45

I wrote the following script to list all of my domain computers with OS and LastLogonTimeStamp vaule. This script also creates a TAB delimited output in text file.

 

Import-Module ActiveDirectory

$computers = Get-ADComputer -Filter * -Properties name,operatingsystem,lastlogontimestamp -ResultPageSize 0
“Computer Name`tOperating System`tLast Logon Date/Time” | Out-File -FilePath .\DomainComputers.txt
foreach ($computer in $computers)
{
   $computer.name + “`t” + $computer.OperatingSystem + “`t” + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp)
    $computer.name + “`t” + $computer.OperatingSystem + “`t” + [DateTime]::FromFileTime([Int64] $computer.lastlogontimestamp) | Out-File -FilePath .\DomainComputers.txt -Append
}

3 thoughts on “LastLogonTimeStamp: How to parse the 18 digit number in PowerShell?

  1. That’s nice, but your output:

    02/09/2014 22:10:45

    isn’t sortable. It should look like:
    2014-02-09 22:10:45Z

    Any idea how you do that?

  2. [DateTime]::FromFileTime([Int64] $u.LastLogonTimeStamp).tostring(“yyyy-MM-dd hh-mm-ss”)

    this should do that work of 2014-02-09 22:10:45Z

    1. This worked for me:
      (@{Name=”LastLogon”; Expression={[DateTime]::FromFileTime($_.LastLogonTimeStamp).ToString(“u”)}})

Leave a Reply to Kurt Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s