fnLDAPQuery() has some samples of using the pwdlastset property.