final ticks question

[stanl]

I have another need to understand ticks as representing Active Directory logins, again using System.Datetime and CLR.  Below is a bit of scrambled, albeit workable, code:  The Datetime class has a FromFileTime() method which is I believe used to convert ADSI ticks represented as an offset from the good old 1601 baseline. The code uses 06/24/2021 01:57:00 PM as both a timestamp and a login time. The timestamp ticks are 637601398200000000 and the ADSI ticks [as I *may* :o  understand] and that number minus 504911232000000000 which are the base ticks.  The code

   
• parses the values into readable dates
• gives a comment line to illustrate why offset is needed
• Does a reverse to create ticks from a datetime object 

I would like the date to be local time, but I get different values depending on returns.


[EDIT]: Code updated to show more variation. I think I understand more, but this is just too interesting to pass up.

Code (WINBATCH) Select Expand



tick = '637601398200000000'
offset = '504911232000000000'  ;year 1600 base
Ticks =  ObjectType('i8',tick)
Ticks1 = ObjectType('i8',tick-offset)
Date1 = ObjectClrNew("System.DateTime")
strDate1 = TimeFormat(Date1.FromFileTime(Ticks1),"MM/dd/yyyy hh:mm:ss t")


;try this to advance the year by 1600, just comment above line and uncomment this
;strDate1 = TimeFormat(Date1.FromFileTime(Ticks),"MM/dd/yyyy hh:mm:ss t")


Date2 = ObjectClrNew("System.DateTime",Ticks)
strDate2 = Date2.ToString()
strDate3 = TimeFormat(Date2.ToLocalTime(),"MM/dd/yyyy hh:mm:ss t")
strDate4 = TimeFormat(Date2.ToUniversalTime(),"MM/dd/yyyy hh:mm:ss t")
result = "ADSI Ticks: ":Ticks1:@LF
result = result:"ADSI Login: ":strDate1:@LF
result = result:"DATETIME Ticks: ":tick:@LF
result = result:"DATETIME: ":strDate2:@LF
result = result:"ToLocalTime(): ":strDate3:@LF
result = result:"ToUniversalTime: ":strDate4




Message("Tick Toc",result)
;strDate2 should return 06/24/2021 01:57:00 PM


;try ADSI time without FromFileTime()
Date2 = ObjectClrNew("System.DateTime",Ticks1)
strDate2 = Date2.ToString()  ;should get the year as 0421 not 2021
Message(Ticks1,strDate2)


;try the reverse "System.DateTime",year,month,day,hour,minute,second,kind) kind=2 [loca]
Date1 = ObjectClrNew("System.DateTime",2021,6,24,13,57,0,2)
Ticks = Date1.Ticks
Date2 = ObjectClrNew("System.DateTime",Ticks)
strDate2 = Date2.ToString()
strDate3 = TimeFormat(Date2.ToLocalTime(),"MM/dd/yyyy hh:mm:ss t")
strDate4 = TimeFormat(Date2.ToUniversalTime(),"MM/dd/yyyy hh:mm:ss t")
Message(Ticks,strDate2:@LF:strDate3:@LF:strDate4)



[stanl]

Guess I never asked the question, I know I can change a line in the code to



;try ADSI time without FromFileTime()
Date2 = ObjectClrNew("System.DateTime",Ticks1+offset)


assuming that Ticks1 was the ADSI value returned to calculate from. But is that UTC or Local time? This is important for assigning values where the utc<>local times cross midnight.

[td]

ADSI time properties are usually UTC but you should check each property's MSFT documentation to be sure.