Convert Active Directory "LastLogon:" time to (UNIX) readable time

Microsoft Active Directory stored dates in a specific format, quoted from a Microsoft support page:

The Active Directory stores date/time values as the number of 100-nanosecond intervals that have elapsed since the 0 hour on January 1, 1601 till the date/time that is being stored.
The time is always stored in Greenwich Mean Time (GMT) in the Active Directory.
Some examples of Active Directory attributes that store date/time values are LastLogon, LastLogonTimestamp and LastPwdSet.
In order to obtain the date/time value stored in these attributes into a standard format, some conversion is required. This article describes how this conversion can be done.

UNIX/Linux stores time in seconds since 01-01-1970. To convert the Microsoft Active Directory timestamp, use this formula, as written in Bourne Again Shell:

echo $((($WindowsTimeStamp/10000000)-11676009600))

When searching the internet, you will find many formulas that use the number 11644473600. This is the number of seconds since 31-12-1601, which is used to calculate the "accountExpires" value. The values "lastLogon" and "lastLogonTimeStamp" however use 01-01-1601 as the date to calculate this value.

Be aware, "LastLogon" and "LastLogonTimeStamp" are only synchronized once each 14 days! To find the most recent value, you'd have to query each Domain Controller in the network.

To convert a UNIX timestamp to human readable time, use this Bourne Again Shell command:

date -d "1970-01-01 $UNIXTimeStamp sec GMT"

Comments

Windows tool to convert to

Windows tool to convert to readable format

I just discovered this tool that can be used to convert the timestamp values to a readable format:

http://technet.microsoft.com/en-us/library/cc773263%28WS.10%29.aspx

In summary you can convert the timestamp value to a readable format on a windows box using the following command:

w32tm /ntte

Conversion is made to local time. Here's an example:

C:\WINNT>w32tm /ntte 128905137323318000
149195 18:15:32.3318000 - 6/26/2009 12:15:32 PM (local time)

Well done timestamp

Well done timestamp converter! Nice work.

thanks for the shortness of

thanks for the shortness of your example

Works great! Thanks for

Works great! Thanks for posting the info.

Is the subtraction number

Is the subtraction number correct? The date I was getting by this method appears to be a year (and a leapday?) off.
I found another solution that was similar but used 11644473600 instead -- this number appears to be correct.

I found the same thing!

I found the same thing! Thanks for posting the updated number!

Me too, this example is wrong

Me too, this example is wrong and the author should update the post since this is a top google result. The magic number is 11644473600, not 11676009600:

windows_time/10000000-11644473600

About Consultancy Articles Contact




References Red Hat Certified Architect By Robert de Bock Robert de Bock
Curriculum Vitae By Fred Clausen +31 6 14 39 58 72
By Nelson Manning [email protected]