AD-ComputerLastLogon/.claude-context/sessions/2026-02-02-logon-audit-scripts.md

Computer & User Last-Logon Audit Scripts

Date: 2026-02-02 Project: AD-ComputerLastLogon Status: resolved Tags: powershell, active-directory, domain-controller, event-log, 4624, csv, performance

Context

Jess needed a script to run on a DC that takes a PC name and reports when it last authenticated to the domain. This grew into a second script that reads DC security logs to work out which PC each user last logged into and exports it to CSV. Work spanned 2026-01-19 to 2026-02-02, with most effort going into making the event-log scan correct and fast.

Key Decisions

• Report both LastLogonTimestamp and LastLogon — the former is replicated across DCs but only updates roughly every 14 days; the latter is accurate but DC-specific. Showing both avoids misreading a stale machine as active (or vice versa).
• Security event log (4624) for user→PC mapping — AD attributes don't record which workstation a user signed into, so logon events are the only source.
• FilterHashtable instead of XPath for Get-WinEvent — XPath queries were brittle and gave poor errors.
• Include logon Type 3 (network) as well as interactive — many school logons surface as network logons at the DC.
• Bulk-preload AD users once rather than Get-ADUser per event — per-event lookups dominated runtime.
• Skip users already resolved (newest-first) — only the most recent PC per user matters.
• Properties[] index access over regex against event XML — the regex approach returned 0 matches on real data and was slower; index access fixed both.
• FQDN (DNSName) instead of raw IP in output — IPs change via DHCP and are less useful to a human reading the report.

Technical Details

• Get-ComputerLastLogon.ps1 [-ComputerName <name>] — prompts if no name given. Outputs replicated/DC-local last logon, days since logon, enabled flag, OS, created date, description, DN.
• Get-UserLastLogonComputer.ps1 — scans DC Security log for event ID 4624, resolves source IP to hostname, joins to AD display names, exports CSV.
• CSV columns: Date, Username, Display Name, PC Name, DNS, IP.
• Requirements: ActiveDirectory module (RSAT), run on a DC as Administrator (Security log read).
• Security log retention on the DC limits how far back the user→PC report can see.

Code Changes

• Get-ComputerLastLogon.ps1 — new; single-computer last-auth lookup.
• Get-UserLastLogonComputer.ps1 — new; event-log scan with Type 3 support, AD display name lookup, bulk preload, early-skip, Properties[] extraction, CSV export.
• README.md — documents both scripts, output fields and requirements.

Open Questions / Next Steps

• Only queries the DC it runs on; for multi-DC environments, results could miss logons serviced by another DC. Consider looping over Get-ADDomainController -Filter * if that becomes an issue.
• Consider an optional -Days parameter to bound the event scan window.

Artifacts

• d5f8269 — Switch from regex XML to Properties[] index access
• 15f0ad4 — Performance optimisation (bulk AD preload, early-skip)
• 3816818 — Include Type 3 network logons, resolve IP to hostname
• 5a76c44 — FilterHashtable instead of XPath
• Repo: https://gitea.hideawaygaming.com.au/jessikitty/AD-ComputerLastLogon