Two Second Time Stamp Differences

• Microsoft Windows NT operating system version 3.1
• Microsoft Windows NT Advanced Server version 3.1
• Microsoft Windows NT Workstation versions 3.5 and 3.51
• Microsoft Windows NT Server versions 3.5 and 3.51
• Microsoft LAN Manager version 2.2c
• Microsoft Windows for Workgroups version 3.11

SUMMARY

When a LAN Manager or Windows for Workgroups client runs a directory search against files on a Windows NT share that reside on an NTFS drive, the time stamp displayed could be off by as much as two seconds.

MORE INFORMATION

The "Windows for Workgroups 3.1a" dialect is negotiated for Windows for Workgroup clients and "DOS LANMAN2.1" is negotiated for a LAN Manager clients. The SMB command that is issued for these dialects for directory searches is File Search. This command returns the Last Modify Time through the find_buf_time field (which displays only the modification time in two second increments). This is an SMB specification for the "File Search" command find_buf_time field. The application running on the LAN Manager or Windows for Workgroups computer can display only what the SMB passes to it. In this case, it is passing a file time stamp that has been rounded off by two second increments.

Windows NT computers negotiate a dialect of "NT LM 0.12" which uses the TRANSACT2_FINDFIRST function from the SMB specification for directory searches. The TRANSACT2_FINDFIRST function does not have this two second time stamp limitation.

For example, a LAN Manager or Windows for Workgroups computer will see a file on a Windows NT share that resides on an NTFS drive with a time stamp (last modify time) of 12:30:52.0. A Windows NT computer will see that same file with a time stamp (Last Write Time) of 19:30:50.674. Convert this time stamp to Pacific Daylight Savings Time and it will be 12:30:50.674.