ldapsearch: How do I query pwdLastSet and have it make sense?

Question

Hi all I have same problem as here: enter link description here, but I need it for ldapserach not in Powershell.

my command:

ldapsearch -LLL -H ldap://<HOST>:<POST> -D 'CN=<CN>' -w <PASSWD> '(samaccountname=<NAME>)' pwdlastset

output:

dn: <SOME_DN>
pwdLastSet: 131267839972407395

Try with `ldapsearch -LLL -H ldap://: -D 'CN=' -w '(samaccountname=)' pwdlastset | perl -pne 's/(\d{11})\d{7}/scalar(localtime($1-11644473600))/e'` — Federico Sierra, Mar 06 '17 at 15:23

score 0 · Answer 1 · answered Mar 06 '17 at 14:54

You get a filetime attribute back by the query. It is defined as 100-nanoseconds since Jan 1 1601.

You can convert that with any modern programming language.

For example in bash

date -d "1601/1/1+$(expr $filetime / 10000000 )Seconds"

or Python

datetime(1601,1,1) + timedelta(microseconds=filetime/10)

1 Answers1