How do I convert pwdLastSet or lastLogonTimestamp to a date?

The value counts 100-nanosecond intervals since 1601-01-01 UTC. Paste it here, or run [datetime]::FromFileTimeUtc(value) in PowerShell or w32tm /ntte value.

Why is lastLogonTimestamp not the real last logon time?

It only updates when the stored value is older than now minus msDS-LogonTimeSyncInterval (14 days by default), so it can lag 9–14 days. For the exact time, compare lastLogon on every domain controller.

What does accountExpires 9223372036854775807 mean?

Never expires; 0 means the same. When a date is set, Active Directory Users and Computers shows the day before as "End of".

Why is maxPwdAge negative?

Intervals are stored as a negative count of 100 ns units: -36288000000000 is 42 days. The password expires at pwdLastSet plus the absolute value.

How do I convert a FILETIME in Excel?

Use =A1/864000000000-109205 for UTC and add your offset in hours divided by 24. Excel keeps 15 digits, so sub-second precision is lost.

How to read pwdLastSet, lastLogonTimestamp and accountExpires

How to use it

Paste an 18-digit value or a line like "pwdLastSet : 134…".
Read the date in UTC, your time zone and one you pick.
Pick a date to get the FILETIME and LDAP filter examples.
Paste Get-ADUser or ldifde output to convert every timestamp.

Accepted formats

Format	Example	What it is
FILETIME (LDAP Integer8)	`134347122000000000`	100 ns intervals since 1601-01-01 00:00 UTC: pwdLastSet, lastLogon, lastLogonTimestamp, accountExpires, badPasswordTime, lockoutTime
Hex	`0x01DD2D4D7C4C8000`	64-bit value; top bit set means negative (two's complement)
Interval (negative)	`-36288000000000`	maxPwdAge, minPwdAge, lockoutDuration, lockOutObservationWindow; this one is 42 days
Generalized time	`20260924083000.0Z`	whenCreated, whenChanged; Z means UTC
Unix seconds / ms	`1758702600`	Since 1970-01-01 UTC (10 or 13 digits)
.NET DateTime.Ticks	`639000000000000000`	100 ns since 0001-01-01; offset from FILETIME 504911232000000000

"Auto" reads 10–11 digits as Unix seconds, 12–14 digits as Unix milliseconds and anything else as FILETIME. If a FILETIME would land after 2200, the .NET ticks reading is shown too.

Special values: 0, 9223372036854775807 and negatives

accountExpires 0 or 9223372036854775807 means never expires. pwdLastSet 0 means the user must change the password at next logon. Negative values such as maxPwdAge are intervals, not dates.

All special values

Attribute	Value	Meaning
accountExpires	`9223372036854775807` (0x7FFFFFFFFFFFFFFF)	Never; default for a new account
accountExpires	`0`	Never; set when an end date is removed
pwdLastSet	`0`	Must change password at next logon (unless Password never expires)
pwdLastSet	`-1` (write only)	Clears "must change password at next logon"
lastLogon, lastLogonTimestamp	`0`	No record
lockoutTime	`0`	Not locked out
msDS-UserPasswordExpiryTimeComputed	`9223372036854775807`	Password never expires (flag set, smart card required, computer or trust account, or unlimited maximum age)
msDS-UserPasswordExpiryTimeComputed	`0`	pwdLastSet is 0 or not set
maxPwdAge	`-9223372036854775808` (0x8000000000000000)	Unlimited maximum password age

msDS-UserPasswordExpiryTimeComputed holds the actual password expiry, including fine-grained password policies. lastLogon is stored per domain controller and is not replicated.

Frequently asked questions

How do I convert pwdLastSet or lastLogonTimestamp to a date?: The value counts 100-nanosecond intervals since 1601-01-01 UTC. Paste it here, or run [datetime]::FromFileTimeUtc(value) in PowerShell or w32tm /ntte value.
Why is lastLogonTimestamp not the real last logon time?: It only updates when the stored value is older than now minus msDS-LogonTimeSyncInterval (14 days by default), so it can lag 9–14 days. For the exact time, compare lastLogon on every domain controller.
What does accountExpires 9223372036854775807 mean?: Never expires; 0 means the same. When a date is set, Active Directory Users and Computers shows the day before as "End of".
Why is maxPwdAge negative?: Intervals are stored as a negative count of 100 ns units: -36288000000000 is 42 days. The password expires at pwdLastSet plus the absolute value.
How do I convert a FILETIME in Excel?: Use =A1/864000000000-109205 for UTC and add your offset in hours divided by 24. Excel keeps 15 digits, so sub-second precision is lost.

Sources

Sources: Microsoft Learn (Active Directory Schema and others), [MS-ADTS], [MS-SAMR]. Last checked 2026-09-24.

Links to the documents

File Times (definition of FILETIME)
Pwd-Last-Set, User Security Attributes (pwdLastSet 0 and -1)
Account-Expires, Account Expiration (LDAP Provider) (never values, ADUC one-day difference)
Last-Logon-Timestamp, KB 2679653 (9–14 day lag), Last-Logon, Lockout-Time
Lockout-Duration, [MS-SAMR] 1.1 Glossary (delta time) (negative intervals)
[MS-ADTS] 3.1.1.4.5.33 msDS-UserPasswordExpiryTimeComputed
Policy CSP - DeviceLock: MaximumPasswordAge (default 42 days)
String(Generalized-Time) syntax
KB 555936 (w32tm /ntte; its example is one of our test vectors)
DateTime.Ticks

Notes and your data

Values and pasted text are converted in this browser and never uploaded.
Only your time zone choice is stored (localStorage key filetime_tz).
Share links keep the value after the "#", which is never sent to a server.

Feedback form (Google Forms, in Japanese; you can write in English). We read every message but do not reply.

Site-wide: About · Privacy policy.

Changelog

2026-09-24 Published