43 lines
3.2 KiB
Markdown
43 lines
3.2 KiB
Markdown
# Computer & User Last-Logon Audit Scripts
|
|
|
|
**Date:** 2026-02-02
|
|
**Project:** AD-ComputerLastLogon
|
|
**Status:** resolved
|
|
**Tags:** powershell, active-directory, domain-controller, event-log, 4624, csv, performance
|
|
|
|
## Context
|
|
Jess needed a script to run on a DC that takes a PC name and reports when it last authenticated to the domain. This grew into a second script that reads DC security logs to work out which PC each user last logged into and exports it to CSV. Work spanned 2026-01-19 to 2026-02-02, with most effort going into making the event-log scan correct and fast.
|
|
|
|
## Key Decisions
|
|
- **Report both `LastLogonTimestamp` and `LastLogon`** — the former is replicated across DCs but only updates roughly every 14 days; the latter is accurate but DC-specific. Showing both avoids misreading a stale machine as active (or vice versa).
|
|
- **Security event log (4624) for user→PC mapping** — AD attributes don't record which workstation a user signed into, so logon events are the only source.
|
|
- **`FilterHashtable` instead of XPath** for `Get-WinEvent` — XPath queries were brittle and gave poor errors.
|
|
- **Include logon Type 3 (network)** as well as interactive — many school logons surface as network logons at the DC.
|
|
- **Bulk-preload AD users once** rather than `Get-ADUser` per event — per-event lookups dominated runtime.
|
|
- **Skip users already resolved (newest-first)** — only the most recent PC per user matters.
|
|
- **`Properties[]` index access** over regex against event XML — the regex approach returned 0 matches on real data and was slower; index access fixed both.
|
|
- **FQDN (`DNSName`) instead of raw IP** in output — IPs change via DHCP and are less useful to a human reading the report.
|
|
|
|
## Technical Details
|
|
- `Get-ComputerLastLogon.ps1 [-ComputerName <name>]` — prompts if no name given. Outputs replicated/DC-local last logon, days since logon, enabled flag, OS, created date, description, DN.
|
|
- `Get-UserLastLogonComputer.ps1` — scans DC Security log for event ID 4624, resolves source IP to hostname, joins to AD display names, exports CSV.
|
|
- CSV columns: `Date, Username, Display Name, PC Name, DNS, IP`.
|
|
- Requirements: ActiveDirectory module (RSAT), run on a DC as Administrator (Security log read).
|
|
- Security log retention on the DC limits how far back the user→PC report can see.
|
|
|
|
## Code Changes
|
|
- `Get-ComputerLastLogon.ps1` — new; single-computer last-auth lookup.
|
|
- `Get-UserLastLogonComputer.ps1` — new; event-log scan with Type 3 support, AD display name lookup, bulk preload, early-skip, `Properties[]` extraction, CSV export.
|
|
- `README.md` — documents both scripts, output fields and requirements.
|
|
|
|
## Open Questions / Next Steps
|
|
- Only queries the DC it runs on; for multi-DC environments, results could miss logons serviced by another DC. Consider looping over `Get-ADDomainController -Filter *` if that becomes an issue.
|
|
- Consider an optional `-Days` parameter to bound the event scan window.
|
|
|
|
## Artifacts
|
|
- `d5f8269` — Switch from regex XML to Properties[] index access
|
|
- `15f0ad4` — Performance optimisation (bulk AD preload, early-skip)
|
|
- `3816818` — Include Type 3 network logons, resolve IP to hostname
|
|
- `5a76c44` — FilterHashtable instead of XPath
|
|
- Repo: https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon
|