I would like to know how it is possible to convert the LastLogonTimestamp found in the SCCM database to a readable format. The code I have now is the following:
$SCCMServer = 'SERVERSCCM'
$SCCMModule = 'C:\Program Files (x86)\Microsoft Configuration Manager\bin\ConfigurationManager.psd1'
$SamAccountName = 'test'
Function Get-SCCMSite {
Param (
[Parameter(Mandatory=$true)]
[String]$ComputerName
)
Process {
Get-WmiObject -ComputerName $ComputerName -Namespace 'root\SMS' -Class 'SMS_ProviderLocation' |
ForEach-Object{
if ($_.ProviderForLocalSite -eq $true) {$SiteCode=$_.sitecode}
}
if ($SiteCode -eq '') {
throw ('Sitecode of ConfigMgr Site at ' + $ComputerName + ' could not be determined.')
}
else {
Return $SiteCode
}
}
}
Import-Module $SCCMModule
$SCCMSite = Get-SCCMSite -ComputerName $SCCMServer
Set-Location "$SCCMSite`:"
$SCCMNameSpace="root\SMS\site_$SCCMSite"
Get-WmiObject -namespace $SCCMNameSpace -computer $SCCMServer -query "select * from sms_r_system where LastLogonUserName='$SamAccountName'" | select *
The output of LastLogonTimestamp
looks like this:
LastLogonTimestamp : 20150330132039.000000+***
On the web I found that this format could be converted to a readable format like this:
[datetime]::FromFileTime(20150330132039.000000+***).ToString('d MMMM yyyy')
But it's not really working as it outputs errors. When I remove the last part behind the .
it gives me a date in 1601, which is definitely incorrect.
I don't think the FromFileTime
method is the correct one for this situation.
You can use the ParseExact
method with a bit of manipulation of the original value:
> $lastlogonstamp = "20150330132039.000000+***"
> $dt = [datetime]::parseexact($lastlogonstamp.split('.')[0],"yyyyMMddHHmmss",[System.Globalization.CultureInfo]::InvariantCulture)
> $dt
30 March 2015 13:20:39
> $dt.ToString('d MMMM yyyy')
30 March 2015