# Computer & User Last-Logon Audit Scripts

**Date:** 2026-02-02
**Project:** AD-ComputerLastLogon
**Status:** resolved
**Tags:** powershell, active-directory, domain-controller, event-log, 4624, csv, performance

## Context
Jess needed a script to run on a DC that takes a PC name and reports when it last authenticated to the domain. This grew into a second script that reads DC security logs to work out which PC each user last logged into and exports it to CSV. Work spanned 2026-01-19 to 2026-02-02, with most effort going into making the event-log scan correct and fast.

## Key Decisions
- **Report both `LastLogonTimestamp` and `LastLogon`** — the former is replicated across DCs but only updates roughly every 14 days; the latter is accurate but DC-specific. Showing both avoids misreading a stale machine as active (or vice versa).
- **Security event log (4624) for user→PC mapping** — AD attributes don't record which workstation a user signed into, so logon events are the only source.
- **`FilterHashtable` instead of XPath** for `Get-WinEvent` — XPath queries were brittle and gave poor errors.
- **Include logon Type 3 (network)** as well as interactive — many school logons surface as network logons at the DC.
- **Bulk-preload AD users once** rather than `Get-ADUser` per event — per-event lookups dominated runtime.
- **Skip users already resolved (newest-first)** — only the most recent PC per user matters.
- **`Properties[]` index access** over regex against event XML — the regex approach returned 0 matches on real data and was slower; index access fixed both.
- **FQDN (`DNSName`) instead of raw IP** in output — IPs change via DHCP and are less useful to a human reading the report.

## Technical Details
- `Get-ComputerLastLogon.ps1 [-ComputerName <name>]` — prompts if no name given. Outputs replicated/DC-local last logon, days since logon, enabled flag, OS, created date, description, DN.
- `Get-UserLastLogonComputer.ps1` — scans DC Security log for event ID 4624, resolves source IP to hostname, joins to AD display names, exports CSV.
- CSV columns: `Date, Username, Display Name, PC Name, DNS, IP`.
- Requirements: ActiveDirectory module (RSAT), run on a DC as Administrator (Security log read).
- Security log retention on the DC limits how far back the user→PC report can see.

## Code Changes
- `Get-ComputerLastLogon.ps1` — new; single-computer last-auth lookup.
- `Get-UserLastLogonComputer.ps1` — new; event-log scan with Type 3 support, AD display name lookup, bulk preload, early-skip, `Properties[]` extraction, CSV export.
- `README.md` — documents both scripts, output fields and requirements.

## Open Questions / Next Steps
- Only queries the DC it runs on; for multi-DC environments, results could miss logons serviced by another DC. Consider looping over `Get-ADDomainController -Filter *` if that becomes an issue.
- Consider an optional `-Days` parameter to bound the event scan window.

## Artifacts
- `d5f8269` — Switch from regex XML to Properties[] index access
- `15f0ad4` — Performance optimisation (bulk AD preload, early-skip)
- `3816818` — Include Type 3 network logons, resolve IP to hostname
- `5a76c44` — FilterHashtable instead of XPath
- Repo: https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon