Output Active Directory Lastlogontimestamp in readable format using PowerShell

If, like me, you’re stuck on Windows 2003 AD you are limited as to which cmdlets you can use.

I had a need to find out the last logon time for a bunch of users, so I put together this function (which I shamelessly borrowed from some where on the internet) and decided to post it up here so I could find it again if I needed it.

function Convert-IADSLargeInteger([object]$LargeInteger){ 

	$type = $LargeInteger.GetType() 
	$highPart = $type.InvokeMember("HighPart","GetProperty",$null,$LargeInteger,$null) 
	$lowPart = $type.InvokeMember("LowPart","GetProperty",$null,$LargeInteger,$null) 

	$bytes = [System.BitConverter]::GetBytes($highPart) 
	$tmp = New-Object System.Byte[] 8 
	$highPart = [System.BitConverter]::ToInt64($tmp,0) 
	$bytes = [System.BitConverter]::GetBytes($lowPart) 
	$lowPart = [System.BitConverter]::ToUInt32($bytes,0) 

	$lowPart + $highPart 

$strLDAP = [String] ("LDAP://<ldap path to user>")
$user = [ADSI] $strLDAP
$lastLogon = [DateTime]::FromFileTime([Int64]::Parse($(Convert-IADSLargeInteger $user.lastlogontimestamp.value))) 

write-host ($user.displayname + " last logged on at " + $strLastLogon)

Thanks to whoever wrote the function initially, I have forgotten where I found it.

Comments are closed.