title: SCCM LastLogonTimestamp format queried by PowerShell
body: <p>I would like to know how it is possible to convert the LastLogonTimestamp found in the SCCM database to a readable format. The code I have now is the following:</p>
  
  <pre><code>$SCCMServer = 'SERVERSCCM'
  $SCCMModule = 'C:\Program Files (x86)\Microsoft Configuration Manager\bin\ConfigurationManager.psd1'
  $SamAccountName = 'test'
  
  Function Get-SCCMSite { 
      Param (
          [Parameter(Mandatory=$true)]
          [String]$ComputerName
      )
      Process {
          Get-WmiObject -ComputerName $ComputerName -Namespace 'root\SMS' -Class 'SMS_ProviderLocation' | 
              ForEach-Object{ 
                  if ($_.ProviderForLocalSite -eq $true) {$SiteCode=$_.sitecode} 
          } 
          if ($SiteCode -eq '') {
              throw ('Sitecode of ConfigMgr Site at ' + $ComputerName + ' could not be determined.') 
          }
          else { 
              Return $SiteCode 
          } 
      }
  }
  
  Import-Module $SCCMModule
  $SCCMSite = Get-SCCMSite -ComputerName $SCCMServer
  Set-Location "$SCCMSite`:"
  $SCCMNameSpace="root\SMS\site_$SCCMSite"
  
  Get-WmiObject -namespace $SCCMNameSpace -computer $SCCMServer -query "select * from sms_r_system where LastLogonUserName='$SamAccountName'" | select *
  </code></pre>
  
  <p>The output of <code>LastLogonTimestamp</code> looks like this:</p>
  
  <pre><code>LastLogonTimestamp            : 20150330132039.000000+***
  </code></pre>
  
  <p>On the web I found that this format could be converted to a readable format like this:</p>
  
  <pre><code>[datetime]::FromFileTime(20150330132039.000000+***).ToString('d MMMM yyyy')
  </code></pre>
  
  <p>But it's not really working as it outputs errors. When I remove the last part behind the <code>.</code> it gives me a date in 1601, which is definitely incorrect.</p>