My co-worker was wondering last week whether an old Windows domain user account was still being used by someone. Having managed Windows domain environments at my previous jobs, the first thing I did of course was go to Active Directory and check the LastLogonTimestamp attribute. This attribute is stored in the Active Directory database as a Large Integer so it will need to be converted to a normal date format to make sense of it.
The following PowerShell command can be used to do the conversion (forgot the website where I got this from, will reference it here if I find it again):
$lastLogonTimestamp = "129358017032999046"