AD-ComputerLastLogon/.claude-context/00-overview.md

AD-ComputerLastLogon

PowerShell scripts for Active Directory logon auditing, run on a Domain Controller.

Repository: https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon

Scripts

• Get-ComputerLastLogon.ps1 — when did a given computer last authenticate? (AD attributes)
• Get-UserLastLogonComputer.ps1 — which PC did each user last log into? (DC Security log, event 4624) → CSV

Requirements

• ActiveDirectory module (RSAT), run on a DC as Administrator

Conventions

• Event parsing uses Get-WinEvent -FilterHashtable and Properties[] index access — not XPath, not regex over XML
• AD data is bulk-preloaded once per run, never looked up per event

Session Log

• 2026-02-02 — Computer & User Last-Logon Audit Scripts — Built both scripts; fixed event query, added Type 3 logons and made the event scan fast via bulk preload and Properties[] access

---

Created by: Jess Rogerson (yelling commands at Claude.AI)