Developer Tool
Active Directory attributes like pwdLastSet, lastLogonTimestamp, and accountExpires store 100-nanosecond intervals since January 1, 1601 — the same underlying format as Windows FILETIME. Convert one below.
Pulled from attributes such as pwdLastSet, lastLogonTimestamp, or accountExpires via ldapsearch, PowerShell, or ADSI Edit.
Two raw values show up constantly and mean something other than a real date: 0 means "never set," and 9223372036854775807 (the maximum signed 64-bit integer) means "never expires" when it appears in accountExpires. If a decoded date comes back wildly far in the future or shows an error, check for these sentinel values before assuming the field is corrupted.
This is identical to Windows FILETIME — Active Directory just reuses it. If you're working directly with the Win32 API or NTFS metadata instead of directory attributes, the Windows FILETIME Converter has the same math with terminology matched to that context.
Related
The identical format, used for NTFS and the Win32 API.
Excel, .NET ticks, GPS time, Julian day and more, all at once.
Useful alongside logon-time audits across time zones.