converting pwdlastset to datetime datatype not working from hash table

Question

I have the below code, but pwdlastset and lastlogontimestamp are not properly converting to datetime data types.

$FileTimeUTC = (Get-Date).AddDays(-90).ToFileTimeUtc()
$Credential  = Get-Credential
$Searcher    = new-object -TypeName System.DirectoryServices.DirectorySearcher
$DomainDN    =([adsisearcher]"").SearchRoot.Path
$domain      = new-object -typename System.DirectoryServices.DirectoryEntry -argumentlist $DomainDN, $Credential.UserName, $Credential.GetNetworkCredential().password
$searcher.SearchRoot = $domain
$Searcher.Filter = "(&(objectclass=computer)(operatingsystem=windows*)(!(primarygroupid=516))(!(operatingsystem=*server*))(lastlogontimestamp<=$filetimeutc))"
$Searcher.PropertiesToLoad.Add('Name') | Out-Null
$Searcher.PropertiesToLoad.Add('Description') | Out-Null
$Searcher.PropertiesToLoad.Add('DistinguishedName') | Out-Null
$Searcher.PropertiesToLoad.Add('OperatingSystem') | Out-Null
$Searcher.PropertiesToLoad.Add('OperatingSystemServicePack') | Out-Null
$Searcher.PropertiesToLoad.Add('Created') | Out-Null
$Searcher.PropertiesToLoad.Add('PasswordLastSet') | Out-Null
$Searcher.PropertiesToLoad.Add('LastLogonDate') | Out-Null

$objs = $searcher.FindAll()

$name               = @{n='Name';e={$_.Properties.name}}
$dn                 = @{n='DistinguishedName';e={$_.Properties.distinguishedname}}
$os                 = @{n='OperatingSystem';e={$_.Properties.operatingsystem}}
$osversion          = @{n='OperatingSystemVersion';e={$_.Properties.operatingsystemversion}}
$description        = @{n='Description';e={$_.Properties.description}}
$created            = @{n='Created';e={$_.Properties.whencreated}}
$pwdlastset         = @{n='PasswordLastSet';e={$_.Properties.pwdlastset}}
$lastlogontimestamp = @{n='LastLogonDate';e={[datetime]::FromFileTimeUtc($_.Properties.lastlogontimestamp)}}

$arr = $objs | Select-Object -Property $name, $dn, $os, $osversion, $description, $created, $pwdlastset, $lastlogontimestamp
return $arr

As you can tell I've tried a couple different ways for converting the value to a datetime format. The value for $pwdlastset ends up being the number of 100 nanosecond-steps since 1601. The value for $lastlogontimestamp ends up becoming null even though it really isn't. The raw value of this is just like $pwdlastset.

Any assistance is appreciated.

Answer 1

Both of those values should be 64-bit integers that represent the number of 'ticks' (the number of 100-nanosecond intervals that have elapsed since 12:00 midnight, January 1, 1601 A.D. (C.E.) Coordinated Universal Time (UTC)).

Converting them should work as you've coded them (but you failed to convert the pwdlastset property!). The result (if you pipe it into Get-Method) should show you it has a TypeName of System.DateTime.

However, for that to work, the variable "$_" should one of the items in the $objs array. In other words:

$objs = $searcher.FindAll()

$objs |
    ForEach-Object{
        $arr += [PSCustomObject]@{
                    Name = $_.Properties.name
                    DistinguishedName = $_.Properties.distinguishedname
                    OperatingSystem = $_.Properties.operatingsystem
                    OperatingSystemVersion = $_.Properties.operatingsystemversion
                    Description = $_.Properties.description
                    Created = $_.Properties.whencreated
                    PasswordLastSet = [datetime]::FromFileTimeUtc($_.Properties.pwdlastset)
                    LastLogonDate = [datetime]::FromFileTimeUtc($_.Properties.lastlogontimestamp)
            }