https://community.splunk.com/t5/Security/WMI-Event-Log-Security-Search/m-p/63879#M2125 <P>Hi gharpe2</P> <P>AFAIK you cannot see this kind of information in the <EM>WMI: Security event log</EM> and therefore you cannot search for it. maybe you can use a scripted output to read the users permission and feed that into splunk to make it searchable.</P> <P>cheers</P> Fri, 26 Aug 2011 05:54:00 GMT MuS 2011-08-26T05:54:00Z https://community.splunk.com/t5/Security/WMI-Event-Log-Security-Search/m-p/63878#M2124 <P>Is there a way to search the WMI:Security event log within Windows to find out who has local admin rights on a server?</P> Wed, 24 Aug 2011 16:33:09 GMT https://community.splunk.com/t5/Security/WMI-Event-Log-Security-Search/m-p/63878#M2124 gharpe2 2011-08-24T16:33:09Z https://community.splunk.com/t5/Security/WMI-Event-Log-Security-Search/m-p/63879#M2125 <P>Hi gharpe2</P> <P>AFAIK you cannot see this kind of information in the <EM>WMI: Security event log</EM> and therefore you cannot search for it. maybe you can use a scripted output to read the users permission and feed that into splunk to make it searchable.</P> <P>cheers</P> Fri, 26 Aug 2011 05:54:00 GMT https://community.splunk.com/t5/Security/WMI-Event-Log-Security-Search/m-p/63879#M2125 MuS 2011-08-26T05:54:00Z