lc. Identity Tools
Tools

AD timestamp converter

Turn the numbers Active Directory stores in lastLogonTimestamp, pwdLastSet, accountExpires or whenCreated into dates, and dates back into values you can drop into an LDAP filter.

Processed locally, in your browser
Convert

FILETIME (18 digits), Generalized Time (20261111140000.0Z), Unix seconds or milliseconds, ISO 8601, or a negative AD interval such as maxPwdAge.

Stale accounts filter

Good to know

  • FILETIME counts 100-nanosecond intervals since 1601-01-01 UTC. 0 and 9223372036854775807 are special: in accountExpires both mean "never".
  • lastLogonTimestamp is replicated, but only updated when it is older than ms-DS-Logon-Time-Sync-Interval (14 days by default minus a random 5). It is the right attribute for stale-account reports, not for "last logon today".
  • lastLogon is per domain controller and not replicated: to get the real value you have to query every DC.
  • pwdLastSet = 0 means the user must change the password at next logon.