# AD-ComputerLastLogon

PowerShell scripts for Active Directory logon auditing, run on a Domain Controller.

**Repository:** https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon

## Scripts
- `Get-ComputerLastLogon.ps1` — when did a given computer last authenticate? (AD attributes)
- `Get-UserLastLogonComputer.ps1` — which PC did each user last log into? (DC Security log, event 4624) → CSV

## Requirements
- ActiveDirectory module (RSAT), run on a DC as Administrator

## Conventions
- Event parsing uses `Get-WinEvent -FilterHashtable` and `Properties[]` index access — not XPath, not regex over XML
- AD data is bulk-preloaded once per run, never looked up per event

## Session Log
- 2026-02-02 — Computer & User Last-Logon Audit Scripts — Built both scripts; fixed event query, added Type 3 logons and made the event scan fast via bulk preload and Properties[] access

---
*Created by: Jess Rogerson (yelling commands at Claude.AI)*