topic Re: Monitor AD Group Changes? in Getting Data In

Monitor AD Group Changes?

andybento — Fri, 13 Mar 2015 15:06:54 GMT

Hi All,

Trying to understand how I can get the recent membership changes, query working for Domain Admins group. I want to see what there are changes (eithering adding or removing) users from the Domain Admins. Have tried a few queries but no results.
Wondering anyone out there could assist?

'group-changes-for-group("My Domain Name","Domain Admins")`

Thanks,

Re: Monitor AD Group Changes?

satishsdange — Mon, 16 Mar 2015 03:30:43 GMT

Please try Splunk App for Windows Infra (https://apps.splunk.com/app/1680/). It has prebuilt dashboards for AD environment.

Re: Monitor AD Group Changes?

Simon_Mantell — Thu, 26 Apr 2018 06:20:48 GMT

If you've got AD data coming in, you can run something like this. Have it set to run every 5 minutes, and send a notification if it detects a the windows log event. Your sed commands will vary based on your local structure.

index=*index_name* (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now (Group_Name="*Domain Admins*" OR Group_Name="*Group2*")
| rename src_user AS "Actioned By", src_user_first AS "First Name" src_user_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g" 
| rex mode=sed field="Account_Name" "s/\\\//g" 
| table "Actioned By"  "First Name"  "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

Re: Monitor AD Group Changes?

bmartins- — Mon, 29 Apr 2024 15:40:39 GMT

May I ask if you're using this to track Exchange distribution group changes?

Based on my testing, and thanks a lot for sharing your query, it generates a lot of events, because, even if you just remove a member from a group, Exchange will remove and re-add the others...

Has anyone found a way to work around this?

Cheers!

Re: Monitor AD Group Changes?

bmartins- — Mon, 29 Apr 2024 15:41:22 GMT

Is there any free alternative to this, as it went out of support?

Many thanks.