I'm using lastLogonTimeStamp to track the users last logon time as the following code:
$Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$ADSearch = New-Object System.DirectoryServices.DirectorySearcher
$ADSearch.SearchRoot ="LDAP://$Domain"
$ADSearch.SearchScope = "subtree"
$ADSearch.PageSize = 100
$ADSearch.Filter = "(objectClass=user)"
$properies = @("distinguishedName",
"sAMAccountName",
"mail",
"lastLogonTimeStamp")
foreach ($pro in $properies) {
$ADSearch.PropertiesToLoad.add($pro)
}
$userObjects = $ADSearch.FindAll()
foreach ($user in $userObjects) {
$logon = $user.Properties.Item("lastLogonTimeStamp")[0]
$lastLogon = [datetime]::fromfiletime($logon)
$lastLogon= $lastLogon.ToString("yyyy/MM/dd")
$lastLogon
}
I've gotten so far:
1601/01/01
1601/01/01
3/12/2012
1601/01/01
3/19/2015
This is not the first time I'm bloody confused about the 1601/01/01 value. And I've read also the MS document about this value and for me it's nonsense, it does not describe much what is the purposes of it. Not only lastLogonTimeStamp has this output, many other attributes have return this as well. So my questions are:
- What is the purpose of this value?
- In this case, what should I return as a proper human readable output ? (This attribute is not valid for this user?)