topic Re: active directory new create and delete user query in Security

active directory new create and delete user query

khanlarloo — Wed, 15 May 2019 15:10:22 GMT

i want to show active directory created user and show deleted users.
what is the query for searching in ldapsearch ?
install windows infrastructure app,but when i create user in ad the app doesn't show the created user in users -- >new user
and also when i delete user account it doesn't show my deleted user.

Re: active directory new create and delete user query

richgalloway — Thu, 16 May 2019 13:05:06 GMT

LDAP search can tell you who is in AD and in which groups, but does not tell you when users are added or removed. For that, you need Windows event logs. Install the Splunk Universal Forwarder on your domain controller and enable the WinEventLog:Security input. This will send events to Splunk each time a user is added or deleted (among many other events). You can then create searches to find and display created and deleted users.

Re: active directory new create and delete user query

khanlarloo — Fri, 17 May 2019 07:48:03 GMT

i installed Splunk Universal Forwarder on my domain controller ,but when i create user on ad it doesn't show any log. even in my windows event viewer

Re: active directory new create and delete user query

dharveynswccd — Fri, 17 May 2019 12:26:58 GMT

@khanlarloo, did you enable WinEventLog:Security input on your DC as suggested by richgalloway? I also have the Splunk App for Windows Infrastructure installed and I am getting those reports. From Active Directory drop-down, go to Users>>User Reports>>Domain Accounts: New, or Domain Accounts: Deleted. Works!

Re: active directory new create and delete user query

khanlarloo — Sat, 18 May 2019 14:42:55 GMT

yes,i put wineventloglog:security input on my dc, but when i create user it doesn't show any log on my app.

Re: active directory new create and delete user query

khanlarloo — Sun, 19 May 2019 03:50:37 GMT

can you tell me, what did you enable in group policy ?

Re: active directory new create and delete user query

danan5 — Wed, 24 Jul 2019 10:14:27 GMT

Could it be the Active Directory audit policy needs to be set to log these events?

https://docs.splunk.com/Documentation/MSExchange/3.5.2/DeployMSX/ConfigureActiveDirectoryauditpolicy