diff --git a/.claude-context/00-overview.md b/.claude-context/00-overview.md
new file mode 100644
index 0000000..a5fe1a0
--- /dev/null
+++ b/.claude-context/00-overview.md
@@ -0,0 +1,22 @@
+# AD-ComputerLastLogon
+
+PowerShell scripts for Active Directory logon auditing, run on a Domain Controller.
+
+**Repository:** https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon
+
+## Scripts
+- `Get-ComputerLastLogon.ps1` — when did a given computer last authenticate? (AD attributes)
+- `Get-UserLastLogonComputer.ps1` — which PC did each user last log into? (DC Security log, event 4624) → CSV
+
+## Requirements
+- ActiveDirectory module (RSAT), run on a DC as Administrator
+
+## Conventions
+- Event parsing uses `Get-WinEvent -FilterHashtable` and `Properties[]` index access — not XPath, not regex over XML
+- AD data is bulk-preloaded once per run, never looked up per event
+
+## Session Log
+- 2026-02-02 — Computer & User Last-Logon Audit Scripts — Built both scripts; fixed event query, added Type 3 logons and made the event scan fast via bulk preload and Properties[] access
+
+---
+*Created by: Jess Rogerson (yelling commands at Claude.AI)*