How to convert the value stored in Reg_Binary into Date/Time?

How to convert the value stored in Reg_Binary into Date/Time?

For example the Last ShutDownTime is stored into the registry:
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows]
"ShutdownTime"=hex:44,a5,0f,47,c9,2c,c6,01
This should be converted into YYYY-MM-DD HH:MM:SS
I did found a function in VB 6.0. but didn't succeed to make a script that return the preferred value.
Things I think are related, but can't succeed put them into a bvscript:
- A file time is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 A.M. January 1, 1601 Coordinated Universal Time (UTC).
- http://www.rlmueller.net/Last%20Logon.htm
Does anyone knows about this issue and has a solution?
Tnx,
kris

Could you post the VB code you found?

What exactly is your goal?  A few things to think about:

The registry is only updated if the system is shutdown properly. If the power plug is pulled, the time will show the last time stamp that the system was properly shutdown. So this may not be the best way to do whatever it is you are trying to do. 

If you can live with last boot time you can do something like this:

 Const wbemFlagReturnImmediately = &h10
 Const wbemFlagForwardOnly = &h20
 
 strComputer = "."
 Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
 Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_OperatingSystem", "WQL", _
     wbemFlagReturnImmediately + wbemFlagForwardOnly)
 
 For Each objItem In colItems
   WScript.Echo "LastBootUpTime: " & WMIDateStringToDate(objItem.LastBootUpTime)
 Next
 
 
 Function WMIDateStringToDate(dtmDate)
 
     cYear = Left(dtmDate, 4)
     cMonth =Mid(dtmDate, 5, 2)
     cDay = Mid(dtmDate, 7, 2)
     cHour = Mid (dtmDate, 9, 2)
     cMin = Mid(dtmDate, 11, 2)
     cSec = Mid(dtmDate,13, 2)
     
     WMIDateStringToDate =  cYear & "-" & cMonth & "-" & cDay & " " _
         & cHour & ":" & cMin & ":" & cSec
 End Function
 

I tried to convert the registry but couldn't figure out how to convert the value.  Here is what I tried.

 Const HKEY_LOCAL_MACHINE = &H80000002
 
 strComputer = "."
 Set StdOut = WScript.StdOut
  
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ 
     strComputer & "\root\default:StdRegProv")
  
 strKeyPath = "SYSTEM\ControlSet001\Control\Windows"
 strValueName = "ShutdownTime"
 oReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath, _
     strValueName,strValue
  
  
 For i = LBound(strValue) To UBound(strValue)
 'Only write one section or the other for testing
 '-----------------------------------------------
   'StdOut.Write  strValue(i)
 '-----------------------------------------------
     'only write one conversation at a time for testing
     aChar = strValue(i)
         'Converts Decimal to Hex
             aHex = Hex(aChar)
                 'StdOut.Writeline "hex: " & aHex
 
         'Converts a Hex value to AscII Char
             StdOut.Writeline "ASCII: " & Chr(CInt("&H" & aHex))
     
         'Converts Character to Decimal value
             aDec = Asc(aHex)
                 'StdOut.Writeline "Decimal: " & Chr(aChar)
 '-----------------------------------------------
 Next
 

The strValue(i) for my system is: "196148971052192301971".

Hope some of this helps.

Cybex

vetterke, I tried a few things and the next code works for me

  strValueName =  _
        "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\" _
              & "ShutdownTime"
  set oShell      = CreateObject("WScript.Shell")
  
  Ar           = oShell.RegRead(strValueName)
  Term       = Ar(7)*(2^56) + Ar(6)*(2^48) + Ar(5)*(2^40) + Ar(4)*(2^32) _
                      + Ar(3)*(2^24) + Ar(2)*(2^16) + Ar(1)*(2^8) + Ar(0)
  
  Days            = Term/(1E7*86400)
  WScript.Echo "ShutdownTime = " & CDate(DateSerial(1601, 1, 1) + Days) _
                             & " UTC"
  
  

Good luck !

Tnx all for replying...
 
I received an solution from someone...
Function dtmDate(RegParam)
 
 'read from the registry using getbinaryvalue
 Const HKEY_CLASSES_ROOT  = &H80000000
 Const HKEY_CURRENT_USER  = &H80000001
 Const HKEY_LOCAL_MACHINE  = &H80000002
 Const HKEY_USERS   = &H80000003
 Const HKEY_CURRENT_CONFIG  = &H80000005
 Dim a(7), oRegistry, oMethod, oInParam, oOutParam, objShell
 
 Select Case RegParam
  Case 1
   sComputer = "."
   sMethod  = "GetBinaryValue"
   hTree  = HKEY_CURRENT_USER
   sKey  = "Software\Microsoft\Windows\CurrentVersion\NetCache\Shares\//vcn/vce-bebruroot\"
   sValue  = "LastSyncTime"
  Case 2
   sComputer = "."
   sMethod  = "GetBinaryValue"
   hTree  = HKEY_CURRENT_USER
   sKey  = "SOFTWARE\MICROSOFT\OFFICE\9.0\Outlook\Options\Backup\"
   sValue  = "last_backup"
  Case 3
    sComputer = "."
   sMethod  = "GetBinaryValue"
   hTree  = HKEY_LOCAL_MACHINE
   sKey  = "system\ControlSet001\Control\Windows"
   sValue  = "ShutdownTime"
 End Select
 
 Set oRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}//" & _
   sComputer & "/root/default:StdRegProv")
 Set oMethod = oRegistry.Methods_(sMethod)
 Set oInParam = oMethod.inParameters.SpawnInstance_()
 
 oInParam.hDefKey = hTree
 oInParam.sSubKeyName = sKey
 oInParam.sValueName = sValue
  
 Set oOutParam = oRegistry.ExecMethod_(sMethod, oInParam)
 For iCount = 0 To UBound(oOutParam.Properties_("uValue"))
  'WScript.Echo oOutParam.Properties_("uValue")(iCount)
  a(iCount)=oOutParam.Properties_("uValue")(iCount)
 Next
 
 ' Obtain local Time Zone bias from machine registry.
 Set objShell = CreateObject("Wscript.Shell")
 lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _
   & "TimeZoneInformation\ActiveTimeBias")
 If UCase(TypeName(lngBiasKey)) = "LONG" Then
   lngBias = lngBiasKey
 ElseIf UCase(TypeName(lngBiasKey)) = "VARIANT()" Then
   lngBias = 0
   For k = 0 To UBound(lngBiasKey)
     lngBias = lngBias + (lngBiasKey(k) * 256^k)
   Next
 End If
 
 'here after blend into rmueller's demonstration
 on error resume next
 lngHigh=0
 lngLow=0
 for i=7 to 4 step -1
     lngHigh=lngHigh*256+a(i)
 next
 for i=3 to 0 step -1
     lngLow=lngLow*256+a(i)
 next
 
 if err.number<>0 then
     dtmDate = #1/1/1601#
     err.clear
 else
     If lngLow < 0 Then
         lngHigh = lngHigh + 1
     End If
     If (lngHigh = 0) And (lngLow = 0 ) Then
         dtmDate = #1/1/1601#
     Else
         dtmDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _
             + lngLow)/600000000 - lngBias)/1440
     End If
 End If
 on error goto 0
End Function
 
 
This wat i needed to use the dates that some programs use to save date/time in the registry