If you’ve ever exported the accountExpires attribute from AD you’ll notice that it’s an 64-bit number. It represents the number of 100-nanosecond intervals since 12:00 AM January 1, 1601 in UTC. What this means is that it’s practically impossible to read unless your a math genius. 😉
Here is a quick VBS script that will take that number and convert it to a real date:
Dim WshShell, oExec, objArgs, exe, work
Set WshShell = CreateObject("WScript.Shell")
Set objArgs = Wscript.Arguments
if objArgs.count = 0 Then
Wscript.Echo "FileTime argument required"
exe = "w32tm.exe /ntte " & objArgs(0)
set oExec = WshShell.Exec(exe)
Do While oExec.Status = 0
work = Split(oExec.StdOut.Read(60))
Wscript.Echo work(3) & " " & work(4)
Just copy and paste this into notepad and save as finddate.vbs. Then just run "finddate.vbs <accountExpires value>"
Would result in this pop up: