How do you read the pwdLastSet LDAP attribute???

  • Thread starter Thread starter dude
  • Start date Start date
D

dude

We've got SOX compliant activities going on recently and I have exported
the pwdLastSet attribute to find out when password was last set for all the
users. However, I get a mysterious code like so: 127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but i certainly
can't pull up every single user's property to do that, hence the export
function. Can anyone tell me how to read that or decode it?
 
Here is an article that shows how Microsoft walks you through this
process.... it's long and awkward, especially if you want to do it for more
than a few accounts. I know that they have internal tools that will convert
the decimal number to hex, then convert it to date and time which you could
probably script. As for externally available tools, a google search turned
up a JoeWare tool that looks like it will convert the pwdLastSet attribute,
but I haven't verified it.

http://www.joeware.net/win/free/tools/adfind.htm
 
We've got SOX compliant activities going on recently and I have exported
the pwdLastSet attribute to find out when password was last set for all the
users. However, I get a mysterious code like so: 127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but i certainly
can't pull up every single user's property to do that, hence the export
function. Can anyone tell me how to read that or decode it?
Click to expand...

You can use the technique from tip 8079 » How can I convert a long integer FILETIME, like Active Directory attributes lastLogon and pwdLastSet, to a date and time?
in the 'Tips & Tricks' at http://www.jsifaq.com

w32tm /ntte 127656464687151954
147750 12:54:28.7151954 - 07/12/2005 08:54:28 (local time)
 
We've got SOX compliant activities going on recently and I
have exported
the pwdLastSet attribute to find out when password was last
set for all the
users. However, I get a mysterious code like so:
127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but
i certainly
can't pull up every single user's property to do that, hence
the export
function. Can anyone tell me how to read that or decode it?
Click to expand...

use OLDCMP (also from joeware) with the users option

http://www.joeware.net/win/free/tools/oldcmp.htm
 
Back
Top