Event Viewer date/time format from attributes issue

Viktor 0 Reputation points
2023-06-26T10:37:04.4666667+00:00

Below the piece of an event from Event Viewer.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
  <EventID>4738</EventID>
...
  </System>
- <EventData>
...
  <Data Name="PasswordLastSet">01.08.2023 0:00:00</Data>
  <Data Name="AccountExpires">01.08.2023 0:00:00</Data>
...
  </EventData>
  </Event>

There are at least two parameters called PasswordLastSet and AccountExpires which have some date/time format. The question is how can i whether change this format somewhere or read from somewhere? This format can vary from PC to PC so i must know this format.

I use EvtQuery, EvtRender... Windows API to read events data and EvtOpenSession for connecting to multiple PC's.

Windows development | Windows API - Win32
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.