Issue with date modified for NTUSER.DAT

Ryan Pertusio 

noob alert! Late to the party I know, but I got here searching for a solution and others will too.

I believe there's a logic error in this which results in an incorrect conversion for some values of the input.

For it to work the string representation of the low DWORD value has to represent all 32 bits. In other words, some values have leading zeros. If those zeros are missing this effectively bit shifts right the high DWORD value, resulting in the wrong datetime.

The only non-contemporary date you should get is midnight 1/1/1601, the date represented by int zero. I was seeing year 1627 as an example.

Here's an alternate implementation.

Caveat: I am not a PowerShell expert, had to look up how to make a function . I am, however, confident in the logic having been weaned on K&R.

# https://techcommunity.microsoft.com/t5/windows-deployment/issue-with-date-modified-for-ntuser-dat/m-p/102438/page/3
# made a function. Added UnloadDate
# changed the logic of the function

function Get-ProfileTimestamp {
	param (
	$ProfileLoadHigh,$ProfileLoadLow
	)
	
	$a = ([int64]$ProfileLoadHigh -shl 32) -bor ([int64]$ProfileLoadLow)

    return [DateTime]::FromFileTimeutc($a)
}

# Get list of profiles
$profiles = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\*"

# Loop through each profile
Foreach ($profile in $profiles) {
    # Get the SID
    $SID = New-Object System.Security.Principal.SecurityIdentifier($profile.PSChildName)
    # Convert SID to Friendly name
    $FriendlyName = $SID.Translate([System.Security.Principal.NTAccount])

    # Trim and store variables
    $SidTrimmed = $SID.Value
    $FriendlyNameTrimmed = $FriendlyName.Value
	
    $ProfileLoadDate = Get-ProfileTimestamp -ProfileLoadHigh $profile.LocalProfileLoadTimeHigh -ProfileLoadLow $profile.LocalProfileLoadTimeLow
	$ProfileUnLoadDate = Get-ProfileTimestamp -ProfileLoadHigh $profile.LocalProfileUnLoadTimeHigh -ProfileLoadLow $profile.LocalProfileUnLoadTimeLow
	
    # Optional output for example purposes
    Write-Output "SID: $SidTrimmed"
    Write-Output "Friendly Name: $FriendlyNameTrimmed"
    Write-Output "Profile Load Date: $ProfileLoadDate"
    Write-Output "Profile UnLoad Date: $ProfileUnLoadDate"
    Write-Output "`n"
}

For extra credit, how many bits is the data shifted for each missing 0x0?