Google+

Active Directory LastLogonDate

Leave a comment

August 22, 2012 by Ruaan Harmzen

Ok, so I know this has nothing to do with Sharepoint, but it’s one of those things that gets geeks excited and should be shared.

We often integrate and work with Active Directory and today we needed to see when a user last logged onto the domain. Now I am sure there are many tools available but generally we only code against AD so don’t have these applications handy. We have however created a small application that shows all the AD properties in use by a specific user.

So the LastLogonDate field comes along and shows the date as “129893096746885055”. Obviously I could write some code to get this value but that’s just way too much effort, so let’s do it in Excel. Past the number in A1 and then add a formula to a date field:

=(A1/10000000/3600/24)-109207

Presto you have a date. The official explanation of how this field is formatted:

The lastLogon attribute is stored in Active Directory as Integer8 (8 bytes). This means it is a 64-bit number, which cannot be handled directly by VBScript. Instead, the LDAP IADsLargeInteger interface provides HighPart and LowPart methods that break the number into two 32-bit components. The resulting value represents the number of 100 nanosecond intervals since 12:00 AM January 1, 1601. The date represented by this number is in Coordinated Universal Time (UTC). It must be adjusted by the time zone bias in the local machine registry to convert to local time.

Microsoft should really get these bored engineering students to do something else!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: