23 lines
968 B
Markdown
23 lines
968 B
Markdown
# AD-ComputerLastLogon
|
|
|
|
PowerShell scripts for Active Directory logon auditing, run on a Domain Controller.
|
|
|
|
**Repository:** https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon
|
|
|
|
## Scripts
|
|
- `Get-ComputerLastLogon.ps1` — when did a given computer last authenticate? (AD attributes)
|
|
- `Get-UserLastLogonComputer.ps1` — which PC did each user last log into? (DC Security log, event 4624) → CSV
|
|
|
|
## Requirements
|
|
- ActiveDirectory module (RSAT), run on a DC as Administrator
|
|
|
|
## Conventions
|
|
- Event parsing uses `Get-WinEvent -FilterHashtable` and `Properties[]` index access — not XPath, not regex over XML
|
|
- AD data is bulk-preloaded once per run, never looked up per event
|
|
|
|
## Session Log
|
|
- 2026-02-02 — Computer & User Last-Logon Audit Scripts — Built both scripts; fixed event query, added Type 3 logons and made the event scan fast via bulk preload and Properties[] access
|
|
|
|
---
|
|
*Created by: Jess Rogerson (yelling commands at Claude.AI)*
|