diff --git a/.claude-context/sessions/2026-02-02-logon-audit-scripts.md b/.claude-context/sessions/2026-02-02-logon-audit-scripts.md
new file mode 100644
index 0000000..e8de7d8
--- /dev/null
+++ b/.claude-context/sessions/2026-02-02-logon-audit-scripts.md
@@ -0,0 +1,42 @@
+# Computer & User Last-Logon Audit Scripts
+
+**Date:** 2026-02-02
+**Project:** AD-ComputerLastLogon
+**Status:** resolved
+**Tags:** powershell, active-directory, domain-controller, event-log, 4624, csv, performance
+
+## Context
+Jess needed a script to run on a DC that takes a PC name and reports when it last authenticated to the domain. This grew into a second script that reads DC security logs to work out which PC each user last logged into and exports it to CSV. Work spanned 2026-01-19 to 2026-02-02, with most effort going into making the event-log scan correct and fast.
+
+## Key Decisions
+- **Report both `LastLogonTimestamp` and `LastLogon`** — the former is replicated across DCs but only updates roughly every 14 days; the latter is accurate but DC-specific. Showing both avoids misreading a stale machine as active (or vice versa).
+- **Security event log (4624) for user→PC mapping** — AD attributes don't record which workstation a user signed into, so logon events are the only source.
+- **`FilterHashtable` instead of XPath** for `Get-WinEvent` — XPath queries were brittle and gave poor errors.
+- **Include logon Type 3 (network)** as well as interactive — many school logons surface as network logons at the DC.
+- **Bulk-preload AD users once** rather than `Get-ADUser` per event — per-event lookups dominated runtime.
+- **Skip users already resolved (newest-first)** — only the most recent PC per user matters.
+- **`Properties[]` index access** over regex against event XML — the regex approach returned 0 matches on real data and was slower; index access fixed both.
+- **FQDN (`DNSName`) instead of raw IP** in output — IPs change via DHCP and are less useful to a human reading the report.
+
+## Technical Details
+- `Get-ComputerLastLogon.ps1 [-ComputerName <name>]` — prompts if no name given. Outputs replicated/DC-local last logon, days since logon, enabled flag, OS, created date, description, DN.
+- `Get-UserLastLogonComputer.ps1` — scans DC Security log for event ID 4624, resolves source IP to hostname, joins to AD display names, exports CSV.
+- CSV columns: `Date, Username, Display Name, PC Name, DNS, IP`.
+- Requirements: ActiveDirectory module (RSAT), run on a DC as Administrator (Security log read).
+- Security log retention on the DC limits how far back the user→PC report can see.
+
+## Code Changes
+- `Get-ComputerLastLogon.ps1` — new; single-computer last-auth lookup.
+- `Get-UserLastLogonComputer.ps1` — new; event-log scan with Type 3 support, AD display name lookup, bulk preload, early-skip, `Properties[]` extraction, CSV export.
+- `README.md` — documents both scripts, output fields and requirements.
+
+## Open Questions / Next Steps
+- Only queries the DC it runs on; for multi-DC environments, results could miss logons serviced by another DC. Consider looping over `Get-ADDomainController -Filter *` if that becomes an issue.
+- Consider an optional `-Days` parameter to bound the event scan window.
+
+## Artifacts
+- `d5f8269` — Switch from regex XML to Properties[] index access
+- `15f0ad4` — Performance optimisation (bulk AD preload, early-skip)
+- `3816818` — Include Type 3 network logons, resolve IP to hostname
+- `5a76c44` — FilterHashtable instead of XPath
+- Repo: https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon