From 7920871fe56f1810ae355c4edab0d5b3414f4a90 Mon Sep 17 00:00:00 2001 From: jessikitty Date: Thu, 24 Sep 2026 00:12:19 +1000 Subject: [PATCH] docs: add .claude-context project overview --- .claude-context/00-overview.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .claude-context/00-overview.md diff --git a/.claude-context/00-overview.md b/.claude-context/00-overview.md new file mode 100644 index 0000000..a5fe1a0 --- /dev/null +++ b/.claude-context/00-overview.md @@ -0,0 +1,22 @@ +# AD-ComputerLastLogon + +PowerShell scripts for Active Directory logon auditing, run on a Domain Controller. + +**Repository:** https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon + +## Scripts +- `Get-ComputerLastLogon.ps1` — when did a given computer last authenticate? (AD attributes) +- `Get-UserLastLogonComputer.ps1` — which PC did each user last log into? (DC Security log, event 4624) → CSV + +## Requirements +- ActiveDirectory module (RSAT), run on a DC as Administrator + +## Conventions +- Event parsing uses `Get-WinEvent -FilterHashtable` and `Properties[]` index access — not XPath, not regex over XML +- AD data is bulk-preloaded once per run, never looked up per event + +## Session Log +- 2026-02-02 — Computer & User Last-Logon Audit Scripts — Built both scripts; fixed event query, added Type 3 logons and made the event scan fast via bulk preload and Properties[] access + +--- +*Created by: Jess Rogerson (yelling commands at Claude.AI)*