Active Directory Powershell: Quick tip LastLogonTimeStamp and pwdLastSet

 

Here is a quick tip on how to quickly convert properties like LastLogonTimeStamp and pwdLastSet into readable results in your PowerShell Script.

The problem, when running commands like get-aduser or get-adcomputer, results of fields are unreadable and require additional formatting in order to read.

Example:

 get-aduser chad -properties lastlogontimestamp,pwdLastSet | select samaccountname, lastlogontimestamp,pwdLastSet

There are several blogs on how to use a calculated property to convert and display the results, that is not the purpose of this blog entry. For me I usually forget how to do this (older I get the less I remember) and have to review previous scripts on how to do this each time I write one.  I also usually write bigger scripts were I have to perform this same conversion multiple times, which causes my script to grow in size and makes it a little more difficult to read.

This is how most articles and blogs do this conversion.

Example:

 get-aduser chad -properties lastlogontimestamp,pwdLastSet | select samaccountname, `
     @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($_.LastLogonTimeStamp))}},`
     @{Name="pwdLastSet";Expression={([datetime]::FromFileTime($_.pwdLastSet))}}

Now keep in mind copying and pasting this over and over isn't that hard.  But I’m going to provide a way to define it once in a script and then just reference it as needed. In additional going to provide a way to add this to PowerShell ISE as a snippet so that it can be added in a script as needed.

Here is the solution, store the calculated property hash into a variable, reference the variable instead of the entire hash.

Example:

 $hash_lastLogonTimestamp = @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($_.LastLogonTimeStamp))}}
 $hash_pwdLastSet = @{Name="pwdLastSet";Expression={([datetime]::FromFileTime($_.pwdLastSet))}}
  
 get-aduser chad -properties lastlogontimestamp,pwdLastSet | `
     select samaccountname, $hash_lastLogonTimestamp,$hash_pwdLastSet

Using the variable I can define this once and reuse it through out a script or the PowerShell cli

Example:

 $hash_lastLogonTimestamp = @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($_.LastLogonTimeStamp))}}
 $hash_pwdLastSet = @{Name="pwdLastSet";Expression={([datetime]::FromFileTime($_.pwdLastSet))}}
  
 get-aduser chad -properties lastlogontimestamp,pwdLastSet | `
     select samaccountname, $hash_lastLogonTimestamp,$hash_pwdLastSet
 get-adcomputer corp-apps -properties lastlogontimestamp,pwdLastSet | `
     select samaccountname, $hash_lastLogonTimestamp,$hash_pwdLastSet
 get-aduser ryan -properties lastlogontimestamp,pwdLastSet | `
     select samaccountname, $hash_lastLogonTimestamp,$hash_pwdLastSet
 get-adcomputer corp-web01 -properties lastlogontimestamp,pwdLastSet | `
     select samaccountname, $hash_lastLogonTimestamp,$hash_pwdLastSet

For those that use PowerShell ISE,  make this something to easily reference by using ise snippets.  More Information

Here is that cmdlets to run in ISE to make this a snippet:

 New-IseSnippet -Description "Convert Active Directory property LastLogonTimestamp" `
     -Text '$hash_lastLogonTimestamp = @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($_.LastLogonTimeStamp))}}' `
     -Title "Convert LastLogonTimeStamp" -Author "Chad"
  
 New-IseSnippet -Description "Convert Active Directory property pwdLastSet" `
     -Text '$hash_pwdLastSet = @{Name="pwdLastSet";Expression={([datetime]::FromFileTime($_.pwdLastSet))}}' `
     -Title "Convert pwdLastSet" -Author "Chad"

 

In Powershell ISE, put the cursor on the line where the snippet needs to go, Press Ctrl + j and then select the newly created snippet.

Update:

For those that use Visual Studio Code can create snippets just like in ISE More information

Select File, preferences, user snippet, search for PowerShell, Modify the powershell.json with this:

 "Convert LastLogonTimestamp":{
     "prefix": "LastLogonTimestamp",
     "body": [
         "$hash_lastLogonTimestamp = @{Name='LastLogonTimeStamp';Expression={([datetime]::FromFileTime($$_.LastLogonTimeStamp))}}"],
     "description": "Convert Active Directory property LastLogonTimestamp"
 },
 "Convert pwdLastSet":{
     "prefix": "pwdLastSet",
     "body": [
         "$hash_pwdLastSet = @{Name='pwdLastSet';Expression={([datetime]::FromFileTime($$_.pwdLastSet))}}"],
     "description": "Convert Active Directory property pwdLastSet"
 }

With visual code, you can just start typing the prefix to get the code snippet, very easy (pictured Below)

select the code snippet and press enter.

Just like that no longer do I have to look through previous scripts.

That is all I have for now, Hope you find this useful.

-Chad

Comments

• Anonymous
  September 28, 2017
  The comment has been removed
• Anonymous
  October 26, 2017
  7902 835270Enjoyed reading by way of this, very very good stuff, thankyou . 679446
• Anonymous
  December 18, 2017
  Some of the pwdLastSet and lastLogonTimestamp show 12/31/1600 as the date.Any way to fix this?Here is the script:$hash_lastLogonTimestamp = @{Name="LastLogonTimeStamp";Expression={([datetime]::FromFileTime($.LastLogonTimeStamp))}}$hash_pwdLastSet = @{Name="pwdLastSet";Expression={([datetime]::FromFileTime($.pwdLastSet))}}Get-ADUser -Filter * -Properties lastLogonTimestamp, pwdLastSet | Sort pwdLastSet -Descending | Select Surname, GivenName, SamAccountName, Enabled, $hash_lastLogonTimestamp, $hash_pwdLastSet, DistinguishedName | ` Export-CSV -path c:\temp\AllUsers18Dec2017.csv -NoTypeInformationThanks,Denise
  • Anonymous
    January 08, 2018
    The comment has been removed