LDAP timestamp converter
Active Directory stores times as Windows FILETIME: 100-nanosecond intervals since 1601. This decodes `lastLogonTimestamp`, `pwdLastSet`, `accountExpires` and the rest.
How to use the ldap timestamp converter
The sentinel values matter more than the arithmetic here. A pwdLastSet of 0 means the user must change their password at next logon, not that it was set in 1601. An accountExpires of 0 or 9223372036854775807 both mean the account never expires — two different sentinels for the same meaning, which is a known inconsistency in the schema. And lastLogonTimestamp is deliberately imprecise: it is only replicated between domain controllers every 9 to 14 days by default, so a value that looks a fortnight stale usually is not evidence of anything. The precise attribute is lastLogon, which is not replicated at all and therefore differs per controller.
Questions
The user must change their password at next logon. It is a sentinel, not a date in 1601.
By design. It only replicates every 9 to 14 days. The accurate attribute is lastLogon, which is per-controller and not replicated.
Never expires. Confusingly, 0 means the same thing.
No, everything here is UTC. Timestamps are stored in UTC precisely so they are unambiguous; converting to a local zone is a separate step and needs to know the zone.
Yes, identical encoding. Active Directory reuses the Windows format.