My co-worker was wondering last week whether an old Windows domain user account was still being used by someone. Having managed Windows domain environments at my previous jobs, the first thing I did of course was go to Active Directory and check the LastLogonTimestamp attribute. This attribute is stored in the Active Directory database as a Large Integer so it will need to be converted to a normal date format to make sense of it.

The following PowerShell command can be used to do the conversion (forgot the website where I got this from, will reference it here if I find it again):

$lastLogonTimestamp = "129358017032999046"
[DateTime]::FromFiletime([Int64]::Parse($lastLogonTimestamp))