Converting Ticks to DateTime

Occasionally, date and time information are stored as “Ticks” in the format of a so-called “FileTime”. Ticks are 100-nanosecond units since 01/01/1601. Active Directory internally uses this format, yet you can also find it elsewhere.

Reading Windows Installation Time in Ticks

Here is an example reading the Windows installation time in “Ticks”:

$values = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' 
$installDateTicks = $values.InstallTime

$installDateTicks

The result is a (very) large 64-bit number:

 
132457820129777032

Convert ticks to DateTime

To convert ticks to DateTime, use [DateTimeOffset]:

$values = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' 
$installDateTicks = $values.InstallTime

$installDate = [DateTimeOffset]::FromFileTime($installDateTicks)
$installDate.DateTime