ADSI pwdLastSet (to UTC or not to UTC)

[/\/\o\/\/ [MVP]]

I'm a bit confused about the ADSI pwdLastSet int64 value,
I was thinking this was an UTC value, but it seems to be in the Local Time:
Also the PasswordLastChanged method of the ADSI COM object will return a
local time it seems (I did set this password at 17:07 (UTC + 2 ) ) :

$user.pwdLastSet = -1

$ds = New-Object directoryservices.directorysearcher($user)

MowPS>[datetime]::fromfiletime(($ds.findone().properties.pwdlastset)[0])

Monday, July 17, 2006 5:07:05 PM

MowPS>$user.InvokeGet('PasswordLastChanged')

Monday, July 17, 2006 5:07:05 PM

MowPS>[datetime]::fromfiletimeutc(($ds.findone().properties.pwdlastset)[0])

Monday, July 17, 2006 3:07:05 PM

I think this is very strange as I did think all the ADSI Uint64 dates where
in UTC time also most examples calculate the Bias, also this way you do not
know the timezone it was set so its not possible to calculate the precice
time.

any ideas ?

Greetings /\/\o\/\/

[jose...@gmail.com]

pwdlast set is actually represents the number of 100 nanoseconds
intervals since January 1, 1601.

see:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/adschema/a_pwdlastset.asp

here's a script someone created to convert the value accordingly.
http://www.rlmueller.net/Programs/PwdLastSet.txt

[Richard Mueller]

Hi,

The pwdLastSet attribute stores the date value in UTC. However, the
PasswordLastChanged property method converts to local time. When I compare
the value returned by PasswordLastChanged to the value I get when I convert
pwdLastSet to a date (corrected for the local time zone), the values agree
within a second.

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net

<jose...@gmail.com> wrote in message
news:1153150867.9...@m79g2000cwm.googlegroups.com...

[/\/\o\/\/]

Richard Mueller wrote:
> Hi,
>
> The pwdLastSet attribute stores the date value in UTC. However, the
> PasswordLastChanged property method converts to local time. When I compare
> the value returned by PasswordLastChanged to the value I get when I convert
> pwdLastSet to a date (corrected for the local time zone), the values agree
> within a second.
>

Thanks seems I did misunderstand the fromfiletimeUtc function
that will Give it as UTC the other will convert it allready.
so I do need the "normal" fromFileTime

PoSH>[datetime]::fromfileTime([datetime]::now.ToFileTime())

Monday, July 17, 2006 7:23:58 PM

PoSH>[datetime]::fromfileTime([datetime]::now.ToFileTimeutc())

Monday, July 17, 2006 7:24:00 PM

PoSH>[datetime]::fromfileTimeUtc([datetime]::now.ToFileTimeutc())

Monday, July 17, 2006 5:24:25 PM

PoSH>[datetime]::fromfileTimeUtc([datetime]::now.ToFileTime())

Monday, July 17, 2006 5:25:27 PM