when lookup_table['lastLogonTimestamp']
        last_logon = Time.at(0)
        time_value = attribute_value.unpack('Q<')[0]
        if time_value > 0
          last_logon = RubySMB::Field::FileTime.new(time_value).to_time.utc