powershell: converting int64 datetime to something legible

i find that i’m constantly converting AD datetime fields from something that looks like 130552642641560221 to something that looks like 9/15/2014 10:17:44 AM. i don’t know which you prefer, but to me, the second output is the one that most people won’t complain about when i give it to them.

over on stackoverflow.com i found this post that wraps it up pretty nicely. so, let’s say you want to look at the lastlogontimestamp attribute of a user named marcus. here’s a typical command that would show you the output:

get-aduser marcus -properties lastlogontimestamp | select lastlogontimestamp

bam. you get the int64 value. personally, i get lost counting nanoseconds* after i exhaust what i can count on both hands. if you’re like me, you can convert this handily to a readable datetime format like this:

get-aduser marcus -properties lastlogontimestamp | select @{ n='llts'; e={[datetime]::fromfiletime($_.lastlogontimestamp)} }

we’re just creating an expression in the hash table to format lastlogontimestamp to the way we want to read it -- like humans. now, the quest powershell modules will do this automatically. of course, no one uses those anymore, right? :)

 

* and if you were curious, this is the definition of the int64 format -- contains a 64-bit value representing the number of 100-nanosecond intervals since january 1, 1601 (utc).