Kent J. Chen's WebLog

' John Savill
' This is based on Richard Mueller's script on Interger8Date
' conversion, which is copyrighted as below.
' Copyright (c) 2003 Richard L. Mueller
' Hilltop Lab Web site - http://www.rlmueller.net
'
' I simply changed it to output all objects in a passed DN.

Option Explicit

Dim strLdapPath, objConnection, objChild
Dim lngTZBias, objUser, objPwdLastSet
Dim objShell, lngBiasKey, k

' Check that all required arguments have been passed
If Wscript.Arguments.Count < 1 Then
  Wscript.Echo "Arguments required. For example:" & vbCrLf _
    & "cscript listuserpasslastchange.vbs ou=test,dc=demo,dc=test"
  Wscript.Quit(0)
End If

strLdapPath = Wscript.Arguments(0)

' Obtain local Time Zone bias from machine registry.
Set objShell = CreateObject("Wscript.Shell")
lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\"_
  & "TimeZoneInformation\ActiveTimeBias")
If UCase(TypeName(lngBiasKey)) = "LONG" Then
  lngTZBias = lngBiasKey
ElseIf UCase(TypeName(lngBiasKey)) = "VARIANT()" Then
  lngTZBias = 0
  For k = 0 To UBound(lngBiasKey)
    lngTZBias = lngTZBias + (lngBiasKey(k) * 256^k)
  Next
End If

Set objConnection = GetObject("LDAP://" & strLdapPath)
objConnection.Filter = Array("user")

For Each objChild In objConnection
     Set objPwdLastSet = objChild.pwdLastSet

     WScript.Echo objChild.Name & vbTab & _
       Integer8Date(objPwdLastSet, lngTZBias)
Next

Wscript.Echo "Operation Completed"

Function Integer8Date(objDate, lngBias)
' Function to convert Integer8 (64-bit) value to a date, adjusted for
' local time zone bias.
  Dim lngAdjust, lngDate, lngHigh, lngLow
  lngAdjust = lngBias
  lngHigh = objDate.HighPart
  lngLow = objdate.LowPart
' Account for error in IADslargeInteger property methods.
  If lngLow < 0 Then
    lngHigh = lngHigh + 1
  End If
  If (lngHigh = 0) And (lngLow = 0) Then
    lngAdjust = 0
  End If
  lngDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _
    + lngLow) / 600000000 - lngAdjust) / 1440
' Trap error if lngDate is ridiculously huge.
  On Error Resume Next
  Integer8Date = CDate(lngDate)
  If Err.Number <> 0 Then
    On Error GoTo 0
    Integer8Date = #1/1/1601#
  End If
  On Error GoTo 0
End Function

To run the script, use the syntax

cscript listuserpasslastchange.vbs ou=test,dc=demo,dc=test

You'll see output that's similar to this:

CN=Bruce Wayne       11/17/2003 1:30:14 PM
CN=Clark Kent        11/17/2003 1:31:30 PM
CN=Hal Jordan        12/6/2004 2:52:56 PM
CN=Wally West        3/17/2003 9:04:45 AM