topic Re: Active Directory Lockout alerts in Getting Data In

Active Directory Lockout alerts

jared_anderson — Thu, 10 Jan 2013 15:21:08 GMT

I have active directory sending logs to my Splunk server via a Universal forwarder. I want to create alerts for when a user locks themselves out of Active Directory. What is the best way to do this?

Re: Active Directory Lockout alerts

kristian_kolb — Thu, 10 Jan 2013 15:59:44 GMT

Assuming that you have the security log in splunk, the following search would probably work

sourcetype=wineventlog:security host=<your domain controller> Failure_Reason="Account locked out." | eval acc=mvindex(Account_Name,1)| table _time acc

This gives you a list of anyone trying to log in with a locked account. Set up a scheduled search, and report when number of results is > 0.

Hope this helps,

Kristian

Re: Active Directory Lockout alerts

jared_anderson — Thu, 10 Jan 2013 18:29:12 GMT

would this only work if they tried to log in when they were already locked out? If they locked the account out, then never tried to log in again, would this report find anything?

Re: Active Directory Lockout alerts

kristian_kolb — Fri, 11 Jan 2013 08:04:17 GMT

Hmm, yes, I think that this event will be generated the when the account gets locked as well.

Re: Active Directory Lockout alerts

stephennbh — Thu, 28 Feb 2013 02:35:58 GMT

How could I run this search against my whole domain for all the domain controllers instead of one DC host?

Re: Active Directory Lockout alerts

mbenwell — Thu, 28 Feb 2013 05:08:46 GMT

Look at the Active Directory App. As part of this app you will get all sorts of field extractions, dashboards and eventtypes (including one for account lockouts).

So... then just search for the eventtype:

eventtype=msad-account-lockout

Re: Active Directory Lockout alerts

jan_wohlers — Tue, 12 Mar 2013 09:50:41 GMT

EventCode=4740 host=* --> This will show you all lock out events occuring. "Caller Name" ist the server/System from where the lockout comes from

Re: Active Directory Lockout alerts

jared_anderson — Wed, 13 Mar 2013 14:10:58 GMT

I think the problem I have is that we have multiple domain controllers, and the forwarder isn't on the main one. So I don't get the actual lockout event, just the replication across the DCs