https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376274#M45640 <P>Thanks for the answer i will try and do that, i hope i see all the logs coming from the server to splunk </P> Mon, 11 Feb 2019 17:32:02 GMT julian0125 2019-02-11T17:32:02Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376272#M45638 <P>Hello, i need your help, i want to know why i can not see logs from windows event code 4732 (New user) on the splunk search i ony see logs from 4624 and 4634, do i need to configure something?</P> Fri, 08 Feb 2019 00:58:27 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376272#M45638 julian0125 2019-02-08T00:58:27Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376273#M45639 <P>You need to enable the "Audit account management" policy.</P> <P>If you are dealing with just one Windows client, then you can configure local audit policies in the Local Security Policy Editor. Check out this page: <A href="https://helpcenter.netwrix.com/Configure_IT_Infrastructure/Windows_Server/WS_Local_Policies.html">Configure Local Audit Policies</A>.</P> <P>If you are dealing with multiple Windows clients or server, then you should go through the Group Policy Management Editor.</P> <P>EDIT: Check out this page from the Splunk App for Windows Infrastructure: <A href="https://docs.splunk.com/Documentation/MSApp/1.5.1/MSInfra/ConfigureActiveDirectoryauditpolicy">Configure Active Directory audit policy</A>.</P> Fri, 08 Feb 2019 08:10:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376273#M45639 whrg 2019-02-08T08:10:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376274#M45640 <P>Thanks for the answer i will try and do that, i hope i see all the logs coming from the server to splunk </P> Mon, 11 Feb 2019 17:32:02 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Code-4732/m-p/376274#M45640 julian0125 2019-02-11T17:32:02Z