Convert Active Directory Time Stamps On macOS With Ruby

Being in a domain, I query AD a lot to get back general information. You can do this either by using the Remote Server Administration Tools on a Windows desktop, or by opening the Directory Utility on macOS. Sometimes it’s faster if I script it, or I need a piece of information from a query to do something else in a script.

One issue I was bumping my head against was converting Active Directory time stamps to something human readable. For example if I wanted to see the last password reset for a AD record, I might get back this:

SMBPasswordLastSet: 130888075497943613

Not entirely helpfully. At least not until it’s converted. To do that I have a Ruby method. I then pass the time stamp to the method and get back what I want.

def convert_ad_time(ad_timestamp)
    ad_timestamp_to_epoch=(ad_timestamp/10000000)-11644473600
    epoch_to_date=Time.at(ad_timestamp_to_epoch).strftime("%m.%d.%Y")
    return epoch_to_date
end


puts convert_ad_time(130888075497943613)

The output looks like this: 10.08.2015

A much nicer, human readable date. I can then re-use this method in other scripts that query domain information and get back things like, “Last Logon Time” or  “Bad Password Time”.

Script on Github