Convert Int64 TimeStamp to DateTime in Powershell

Some Applications (Ex: Active Directory ) stores DateTime value as TimeStamp value in a way to support different time zone. The Int64 TimeStamp is nothing but Windows file time. The Windows file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC).

In Powershell, we can use the .Net function FromFileTime and convert the output to DateTime format.

$timestamp = "131099683087123361"
[DateTime]::FromFileTimeutc($timestamp)

You can also convert the standard datetime to timestamp value by using the function ToFileTimeUtc.

$date = Get-Date
$date.ToFileTimeUtc()

In Active Directory environment, the attributes LastLogonTimeStamp and PwdLastSet are stored as Int64 TimeStamp. When you query these properties by using Get-ADUser cmdlet, you need to explicitly convert LastLogonTimeStamp value into datetime value.

Get-ADUser -Identity 'Smith' -Properties LastLogonTimeStamp | 
Select-Object -Property "Name", @{n="LastLogon";e={[datetime]::FromFileTime($_."LastLogonTimeStamp")}}

The following powershell command convert AD user’s PwdLastSet value to datetime value.

Get-ADUser -Identity 'Smith' -Properties PwdLastSet | 
Select-Object -Property "Name", @{n="PwdLastSet";e={[datetime]::FromFileTime($_."PwdLastSet")}}