Search code examples
powershellonedrive

OneDrive LastSignInTime Registry to DateTime format


I am trying to check Last Sign in date/time for a onedrive login script but struggling with converting the decimal value returned into a correct date/time format. Wondering if I could get an assist.

$d = (Get-ItemPropertyValue -Path "HKCU:\Software\Microsoft\OneDrive\Accounts\Business1" -Name "LastSignInTime")

this currently returns the following which a GM shows it as a TypeName: System.Int64

1594662535

I have tried various conversion types not exactly knowing how it should be read and so far everything comes back inncorrect to what I would expect.

This

[DateTime]::FromFiletime([Int64]::Parse($d))

returns

Sunday, December 31, 1600 4:02:39 PM

Should I be reading this purely as Time and not expecting a full date, I guess the reg property is labeled Time? Guess I am just hopeful for date but wasn't sure if there is a way to confirm it is purely a time string vs date/time?


Solution

  • It appears as if the value you're receiving is effectively unix time ticks.


    I wasn't sure whether you wanted the date and time:

    [DateTime]$e = '1970-01-01 00:00:00'
    $t = ([DateTime]$e.AddSeconds($d)).ToString()
    

    Or alternatively:

    $t = ([datetimeoffset]::FromUnixTimeSeconds($d).DateTime).ToString()
    

    Expected possible result, (locale dependent), using [Int64]$d = 1594662535:

    PS C:\Users\ATek> Write-Host $t
    07/13/2020 17:48:55
    

    Or just the time only:

    [DateTime]$e = '1970-01-01 00:00:00'
    $t = ([DateTime]$e.AddSeconds($d)).ToString('T')
    

    Or alternatively:

    $t = ([DateTimeOffset]::FromUnixTimeSeconds($d).DateTime).ToString('T')
    

    Expected possible result, (locale dependent), using [Int64]$d = 1594662535:

    PS C:\Users\ATek> Write-Host $t
    17:48:55