How do you read the pwdLastSet LDAP attribute???

[dude]

We've got SOX compliant activities going on recently and I have exported
the pwdLastSet attribute to find out when password was last set for all the
users. However, I get a mysterious code like so: 127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but i certainly
can't pull up every single user's property to do that, hence the export
function. Can anyone tell me how to read that or decode it?

 

[Mike Shepperd]

Here is an article that shows how Microsoft walks you through this
process.... it's long and awkward, especially if you want to do it for more
than a few accounts. I know that they have internal tools that will convert
the decimal number to hex, then convert it to date and time which you could
probably script. As for externally available tools, a google search turned
up a JoeWare tool that looks like it will convert the pwdLastSet attribute,
but I haven't verified it.

http://www.joeware.net/win/free/tools/adfind.htm

 

[Joe Richards [MVP]]

Yep it certainly will. I have confirmed it. ;o)

 

[Jerold Schulman]

We've got SOX compliant activities going on recently and I have exported
the pwdLastSet attribute to find out when password was last set for all the
users. However, I get a mysterious code like so: 127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but i certainly
can't pull up every single user's property to do that, hence the export
function. Can anyone tell me how to read that or decode it?

You can use the technique from tip 8079 » How can I convert a long integer FILETIME, like Active Directory attributes lastLogon and pwdLastSet, to a date and time?
in the 'Tips & Tricks' at http://www.jsifaq.com

w32tm /ntte 127656464687151954
147750 12:54:28.7151954 - 07/12/2005 08:54:28 (local time)

 

[Jorge_de_Almeida_Pinto]

We've got SOX compliant activities going on recently and I
have exported
the pwdLastSet attribute to find out when password was last
set for all the
users. However, I get a mysterious code like so:
127656464687151954

using an AD tool, i can tell that's 7/12/2005 7:54:28 AM, but
i certainly
can't pull up every single user's property to do that, hence
the export
function. Can anyone tell me how to read that or decode it?

use OLDCMP (also from joeware) with the users option

http://www.joeware.net/win/free/tools/oldcmp.htm