有没有办法转换LocalProfileLoadTimeHigh和LocalProfileLoadTimeLow注册表值？

Question

对于Windows 10盒子上的每个配置文件，有一个注册表项称为:微软HKLM SOFTWARE Windows NT CurrentVersion ProfileList {SID}

它们具有LocalProfileLoadTimeHigh和LocalProfileLoadTimeLow属性，其值分别为30904031和3561385903。

有人知道这些数字的格式是什么，以及如何将它们转换为实际日期吗?

Answer 1

要计算最后一次登录或注销时间，请执行以下操作:

1. 打开注册表编辑器并浏览到以下路径:HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileList

   使用以下Powershell代码，您将获得包含用户名，SID，配置文件加载时间和配置文件卸载时间的PSObject:

   $profilelist = Get-ChildItem "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionProfileList"
   foreach ($p in $profilelist) {
   try {
   $objUser = (New-Object System.Security.Principal.SecurityIdentifier($p.PSChildName)).Translate([System.Security.Principal.NTAccount]).value
   } catch {
   $objUser = "[UNKNOWN]"
   }
   Remove-Variable -Force LTH,LTL,UTH,UTL -ErrorAction SilentlyContinue
   $LTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeHigh -ErrorAction SilentlyContinue).LocalProfileLoadTimeHigh
   $LTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeLow -ErrorAction SilentlyContinue).LocalProfileLoadTimeLow
   $UTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeHigh -ErrorAction SilentlyContinue).LocalProfileUnloadTimeHigh
   $UTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeLow -ErrorAction SilentlyContinue).LocalProfileUnloadTimeLow
   $LoadTime = if ($LTH -and $LTL) {
   [datetime]::FromFileTime("0x$LTH$LTL")
   } else {
   $null
   }
   $UnloadTime = if ($UTH -and $UTL) {
   [datetime]::FromFileTime("0x$UTH$UTL")
   } else {
   $null
   }
   [pscustomobject][ordered]@{
   User = $objUser
   SID = $p.PSChildName
   Loadtime = $LoadTime
   UnloadTime = $UnloadTime
   }
   }