Active Directory: LastLogonTimeStamp Conversion
Active Directory stores date/time values as the number of 100-nanosecond intervals that have elapsed since the 0 hour on January 1, 1601 until the date/time that is being stored. The time is always stored in UTC (Coordinated Universal Time, which used to be called Greenwich Mean Time, or GMT) in the Active Directory. Some examples of Active Directory attributes that store date/time values are LastLogon, **LastLogonTimestamp, accountExpires, **and LastPwdSet. In order to obtain the date/time value stored in these attributes into a standard format, some conversion is required. This article describes how this conversion can be done.
Taking advantage of Excel, find the below example: =IF(C2>0,C2/(8.64*10^11) - 109205,"")
Normally we can convert with w32tm; find the below example:
The command:
w32tm.exe /ntte 128271382742968750
will yield:
148462 05:57:54.2968750 - 6/24/2007 8:57:54 AM (local time)
on a computer that is in a time zone three hours ahead of Greenwich Mean Time (GMT +3:00). Notice that the first half of the output displays the time in GMT (05:57:54) and then converts it by adding the Time Zone Offset (8:57:54).
For more references:
http://myserverstuff.blogspot.in/2009/03/csvde-to-excel-human-readable-lastlogon.html
http://social.technet.microsoft.com/Forums/da/ITCG/thread/9d558bbd-8cad-491c-84a8-c9082cee8e5c
http://kpytko.wordpress.com/2012/07/30/lastlogon-vs-lastlogontimestamp/
**How Can I Get a List of All the Objects that have been added to Active Directory Since a Specified Date?