Jump to content
Kovacic

Having trouble converting AD date/time to readable Date/time

Recommended Posts

Hello all.. I am trying to convert Active Directory computer account last used date to a readable format. I have some functions that will do this, but they use the following command to perform the command:

w32tm /ntte <NT time epoch>
  Convert a NT system time, in (10^-7)s intervals from 0h 1-Jan 1601,
  into a readable format.

 

This is super slow when dealing with thousands of records. Here is what I have so far...

 

#include <array.au3>
#include <DateTimeConvert.au3>
#include <Date.au3>
$exampleADTimeStamp = "130793861794571914"
Msgbox(0,"MyResult", "Timestamp: " & $exampleADTimeStamp & @crlf & "Days since last Login: " & DateStringToDaysSinceLastLogin($exampleADTimeStamp))

Func DateStringToDaysSinceLastLogin($Timestamp)
    $ParseOutput = ParseLL($Timestamp)
    $ParseOutput = StringSplit($ParseOutput, " ", 2)
    $newFinal = _DateStandardToCalcDate($ParseOutput[0])
    Return Abs(CompareD($newFinal))
EndFunc   ;==>DateStringToDaysSinceLastLogin
Func ParseLL($oLastLogon)
    $sOutput = ""
    $iPID = Run(@ComSpec & " /c " & "w32tm.exe /ntte " & $oLastLogon, @TempDir, @SW_HIDE, 2)
    While 1
        $sOutput &= StdoutRead($iPID)
        If @error Then ExitLoop
    WEnd
    $sOutput = StringSplit($sOutput, " - ", 2 + 1)
    Return $sOutput[1]
EndFunc   ;==>ParseLL
Func CompareD($Datez)
    Return _DateDiff("D", @YEAR & "/" & @MON & "/" & @MDAY, $Datez)
EndFunc   ;==>CompareD

 

I'm sure there has got to be a better way to calculate this date format without having to use a command line tool, but after searching the forums, I haven't found anything..

Does anyone have any thoughts?

 

Thanks in advance!!!


C0d3 is P0etry( ͡° ͜ʖ ͡°)

Share this post


Link to post
Share on other sites

Found my own answer.. I just need to write up this calculation...

 

 

Convert 18-digit LDAP timestamps to human readable date & epoch

The 18-digit Active Directory timestamps, also named 'Windows NT time format' and 'Win32 FILETIME or SYSTEMTIME'. These are used in Microsoft Active Directory for pwdLastSet, accountExpires, LastLogon, LastLogonTimestamp and LastPwdSet. The timestamp is the number of 100-nanoseconds intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC.

 

 

Thanks anyways! 

 

(I notice i can never find an answer unless I post the Q here first, then I find the answer in minutes.)


C0d3 is P0etry( ͡° ͜ʖ ͡°)

Share this post


Link to post
Share on other sites

Is this accurate enough?

#include <Date.au3>
$exampleADTimeStamp = "130793861794571914"

ConsoleWrite(_DateAdd("s", StringTrimRight($exampleADTimeStamp, 7), "1601/01/01 00:00:00")  & @CRLF)

 


Please don't send me any personal message and ask for support! I will not reply!

Selection of finest graphical examples at Codepen.io

The own fart smells best!
Her 'sikim hıyar' diyene bir avuç tuz alıp koşma!
¯\_(ツ)_/¯  ٩(●̮̮̃•̃)۶ ٩(-̮̮̃-̃)۶ૐ

Share this post


Link to post
Share on other sites

If you are talking about property "lastlogon" search function _AD_GetObjectProperties from my AD UDF for "lastlogon" and you will see how the date is translated into readable format.


My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (2018-12-03 - Version 1.4.11.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2019-03-02 - Version 1.3.5.0) - Download - General Help & Support - Example Scripts - Wiki
Outlook Tools (2019-01-22 - Version 0.1.0.0) - Download - General Help & Support
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
PowerPoint (2017-06-06 - Version 0.0.5.0) - Download - General Help & Support
Excel - Example Scripts - Wiki
Word - Wiki
 
Tutorials:

ADO - Wiki

 

Share this post


Link to post
Share on other sites

If you are talking about property "lastlogon" search function _AD_GetObjectProperties from my AD UDF for "lastlogon" and you will see how the date is translated into readable format.

I tried this, but for some reason, in our environment, it always returned a blank value. Even a raw LDAP attribute query for a computer object returned a blank value which makes no sense.. Its not a UDF issue.. because I can pull any other attribute with no problem, but lastLogonTimeStamp is always blank.. Oddly enough, this works:

dsquery.exe * -limit 0 -filter "&(objectClass=Computer) (sAMAccountName=*)" -attr SamAccountName lastlogontimestamp

I think we just have a wonky AD environment. This is not the first time I saw something not work that very well should work.

 


C0d3 is P0etry( ͡° ͜ʖ ͡°)

Share this post


Link to post
Share on other sites

lastlogon and lastlogontimestamp are two different properties. Did you try "lastlogon"?


My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (2018-12-03 - Version 1.4.11.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2019-03-02 - Version 1.3.5.0) - Download - General Help & Support - Example Scripts - Wiki
Outlook Tools (2019-01-22 - Version 0.1.0.0) - Download - General Help & Support
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
PowerPoint (2017-06-06 - Version 0.0.5.0) - Download - General Help & Support
Excel - Example Scripts - Wiki
Word - Wiki
 
Tutorials:

ADO - Wiki

 

Share this post


Link to post
Share on other sites

lastlogon and lastlogontimestamp are two different properties. Did you try "lastlogon"?

I did, but from what I understand from Microsoft, lastlogon is specific to the domain controller, while LastLogonTimeStamp replicates. They suggest we pull from LastLogonTimeStamp when running reports. 

 

- LastLogon:
                  When a user logs on, this attribute is updated on the Domain Controller that provided the authentication ONLY.  Because it is only updated on one DC, that means this attribute is not replicated.  While that might seem inconvenient at first, this is actually a pretty useful function.  In those cases when you may want to figure out what sites a user has logged on (or not logged on), you would use this attribute.
                  
                  - LastLogonTimeStamp

                  To summarize this attribute, this is the replicated version of the LastLogon attribute.

 


C0d3 is P0etry( ͡° ͜ʖ ͡°)

Share this post


Link to post
Share on other sites

Correct. Then function _AD_GetLastLoginDate is what you need. The function queries all DCs and returns the correct last login date/time.


My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (2018-12-03 - Version 1.4.11.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2019-03-02 - Version 1.3.5.0) - Download - General Help & Support - Example Scripts - Wiki
Outlook Tools (2019-01-22 - Version 0.1.0.0) - Download - General Help & Support
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
PowerPoint (2017-06-06 - Version 0.0.5.0) - Download - General Help & Support
Excel - Example Scripts - Wiki
Word - Wiki
 
Tutorials:

ADO - Wiki

 

Share this post


Link to post
Share on other sites

Correct. Then function _AD_GetLastLoginDate is what you need. The function queries all DCs and returns the correct last login date/time.

It looks like that ended up working, but for some reason, that query takes much longer than a simple dsquery... 

 

This takes about 18 seconds to complete for me:

#include <ad.au3>
_AD_OPEN()
Msgbox(0,"_AD_GetLastLoginDate",_AD_GetLastLoginDate(@computername & "$"))
_AD_CLOSE()

While this takes less than 1 second

dsquery.exe * -limit 0 -filter "&(objectClass=Computer) (sAMAccountName=%computername%$)" -attr SamAccountName lastlogontimestamp

 

While I normally don't mind it taking a few more seconds, I have to query a little over 5000 computer accounts.


C0d3 is P0etry( ͡° ͜ʖ ͡°)

Share this post


Link to post
Share on other sites
_AD_GetLastLoginDate queries ALL DCs to get the correct last logon because this property is - as you have noted - not replicated to other DCs. You can limit the DCs to query to a site or a list of DCs.
Edited by water

My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (2018-12-03 - Version 1.4.11.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2019-03-02 - Version 1.3.5.0) - Download - General Help & Support - Example Scripts - Wiki
Outlook Tools (2019-01-22 - Version 0.1.0.0) - Download - General Help & Support
ExcelChart (2017-07-21 - Version 0.4.0.1) - Download - General Help & Support - Example Scripts
PowerPoint (2017-06-06 - Version 0.0.5.0) - Download - General Help & Support
Excel - Example Scripts - Wiki
Word - Wiki
 
Tutorials:

ADO - Wiki

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By Simpel
      Hi,
      I wanted to use _GetLogonTime() by guinness (https://www.autoitscript.com/forum/topic/19370-autoit-wrappers/?do=findComment&comment=942069).
      #include <Date.au3> #include <Array.au3> ConsoleWrite(_GetLogonTime() & @LF) Func _GetLogonTime($sUserName = @UserName, $sComputerName = @ComputerName) ; Idea by trancexx: http://www.autoitscript.com/forum/topic/113611-if-isadmin-not-detected-as-admin/ Local $aRet = DllCall("netapi32.dll", "long", "NetUserGetInfo", "wstr", $sComputerName, "wstr", $sUserName, "dword", 11, "ptr*", 0) _ArrayDisplay($aRet) If @error Or $aRet[0] Then Return SetError(1, 0, False) Local $sHours = DllStructGetData(DllStructCreate("ptr;ptr;ptr;ptr;dword;dword;dword;ptr;ptr;dword;dword;dword;dword;ptr;dword;ptr;dword;dword;byte;dword", $aRet[4]), 18) DllCall("netapi32.dll", "long", "NetApiBufferFree", "ptr", $aRet[4]) Return _DateAdd("h", "-" & $sHours, _NowCalc()) EndFunc ;==>_GetLogonTime It always returns false.
      I displayed $aRet:
      [0]|2221
      [1]|mycomputer
      [2]|myuser
      [3]|11
      [4]|0x0000000000000000
      $aRet[4] shouldn't be 0x0000000000000000 right? Any help?
      Regards, Conrad
       
    • By Jeep
      Here is an other UDF for string handling :
      Date handling
      _StringDateConvert:  convert a date from one format ("YMD", "MDY" or "DMY") to another.
      _StringIsDate:  checks if a date with a given format is valid
      String management
      _StringCount: count of occurrences that appear in a string
      _StringFormatBytesSize: formatting a dimension expressed in bytes (bytes) in MB, TB, ...)
      _StringIsEndingWith: check if a string end with some characters
      _StringIsStartingWith: check if a string start with some characters
      _StringJoinArray:  concatenate elements of an array to rebuild a string
      _StringPadLeft: filling a string with characters on the left
      _StringPadRight: fill a string with characters on the right
      _StringRemoveFrenchAccent: remove french accent
      _StringRemoveChars: deleting characters from a string
      _StringStrip: eliminate characters at the begin and/or at the  end of a string
      _StringTitleCaseFrench: capitalize the first letter of each word with elimination of french accents
      _StringWSClean: simple replacement of "White Spaces",  remove beginning and trailing spaces and multiple spaces removal
      Any comments, suggestions for improvement or constructive criticism are welcome.
      Below you will find the UDF and a demo program. 
       
       
      JPD_String.zip
    • By Skeletor
      Hey All,
      I'm trying to set the date using a variable.
      Basically, I set the date into the input box, then I change the input box, say, I change the year.
      Then I set what I typed into the input box into the Date Picker.

      This is a demo code.
      #include <ButtonConstants.au3> ;Start GUI includes #include <EditConstants.au3> #include <StaticConstants.au3> #include <WindowsConstants.au3> #include <DateTimeConstants.au3> #include <GUIConstantsEx.au3> #include <GuiDateTimePicker.au3> #Region ### START Koda GUI section ### Form= $Form1 = GUICreate("Form1", 615, 438, 192, 124) $Date1 = GUICtrlCreateDate("2019/02/02 23:16:26", 80, 64, 186, 21, $DTS_SHORTDATEFORMAT) $Input1 = GUICtrlCreateInput("Input1", 80, 152, 185, 21) $Button1 = GUICtrlCreateButton("Set data", 176, 96, 75, 25) $Button2 = GUICtrlCreateButton("Read from input", 176, 200, 75, 25) GUISetState(@SW_SHOW) #EndRegion ### END Koda GUI section ### While 1 $nMsg = GUIGetMsg() Switch $nMsg Case $GUI_EVENT_CLOSE Exit Case $Button1 $Read = GUICtrlRead($Date1) GUICtrlSetData($Input1, $Read) MsgBox(-1, "", $Read) Case $Button2 $Read = GUICtrlRead($Input1) $New_date = StringReplace($Read, "/", "") $DAY = StringLeft($New_date, 2) $MON = StringMid($New_date, 4, 3) $YEAR = StringRight($New_date, 4) MsgBox(-1, "", $DAY & $MON & $YEAR) ;_GUICtrlDTP_SetFormat($hWndDate, "yyyy/MM/dd") $DateFormate = ($DAY & " " & $MON & " " & $YEAR) $DTM_SETFORMAT_ = 0x1032 ; $DTM_SETFORMATW GUICtrlSendMsg($Date1, $DateFormate, 0, "MM/dd/yyyy") EndSwitch WEnd  
    • By rudi
      Hello,
       
      <edit>
      In this posting below you will find a script to get an Active Directory User's Group Memberships including nested Group Memberships:
       
      </edit>
      quite a while ago I started this thread: https://www.autoitscript.com/forum/topic/193984-ad-member-of-group-in-group/
       
      #include <AD.au3> _AD_Open() $user=_AD_SamAccountNameToFQDN("ASP") $group=_AD_SamAccountNameToFQDN("daten-Bestellung-QS_lesen") $result=_AD_IsMemberOf($group,$user,false,True) ; $Group is the 1st, $User the 2nd param ConsoleWrite('@@ Debug(' & @ScriptLineNumber & ') : $result = ' & $result & @CRLF & '>Error code: ' & @error & @CRLF) ;### Debug Console _AD_Close() this works fine, thanks for the help in the other thread.
      Howto to get the "chain" of groups for nested group memberships?

      In AD.AU3 I found the function _AD_RecursiveGetMemberOf(), which might be an approach, (get all the group content then sort out what's needed), just wondering if there is another function that I've overlooked, that directly would give me the "nested membership chain" *ONLY*?
       
      Regards, Rudi.
×
×
  • Create New...