How To Convert Active Directory TimeStamp Property to DateTime

image 2 - How To Convert Active Directory TimeStamp Property to DateTime

Have you ever seen the timestamp format like this and wondered how it’s equivalent to the normal DateTime format?

image 2 - How To Convert Active Directory TimeStamp Property to DateTime

It’s the date/time value stored in Active Directory as the number of 100-nanosecond intervals that have elapsed since the 0 hours on January 1, 1601, until the date/time that is being stored. It’s always in UTC (Coordinated Universal Time, aka. GMT) and is often used in Properties like LastLogonTimeStamp, LastPwdSet, etc. /via Technet/

The formula that can be used in Excel is something like this:

DateTime (UTC) = Timestamp/(8.64*10^11) - 109205
image 4 - How To Convert Active Directory TimeStamp Property to DateTime

You can also use w32tm command line to do the quick conversion as well.

w32tm /ntte timestamp-value
image 5 - How To Convert Active Directory TimeStamp Property to DateTime

The time shown in the second half is for local time in PCT.

Now let’s take look how it converts in PowerShell, which is so easy.

To convert a timestamp to DateTime format in UTC.

[DateTime]::FromFileTimeUtc(TimeStamp-value)
image 6 - How To Convert Active Directory TimeStamp Property to DateTime

Local time, regardless of where you are?

[DateTime]::FromFileTime(TimeStamp-value)
image 7 - How To Convert Active Directory TimeStamp Property to DateTime

Well, that’s one hour off, comparing to using the W32TM command, blame on the summer time saving.

You can also do the conversion the other way around, getting the timestamp from a specified date/time value. For example, to get the present moment in TimeStamp,

(Get-Date).ToFileTime()
image 8 - How To Convert Active Directory TimeStamp Property to DateTime

Hope it helps.

Leave a Reply

Your email address will not be published. Required fields are marked *