<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Active Directory monitor not enumerating existing objects in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16807#M2059</link>
    <description>&lt;P&gt;Thanks. Is there an ETA on 4.1.4?&lt;/P&gt;</description>
    <pubDate>Sat, 03 Jul 2010 01:26:12 GMT</pubDate>
    <dc:creator>erga00</dc:creator>
    <dc:date>2010-07-03T01:26:12Z</dc:date>
    <item>
      <title>Active Directory monitor not enumerating existing objects</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16805#M2057</link>
      <description>&lt;P&gt;I've enabled the Active Directory monitoring module. I'm getting events as objects are modified but I would expect that there would be an initial scan of all objects so that entries for changed objects can be compared to their original value. Another useful byproduct of scanning all objects is that you can then add useful data like department, address, etc to search results. &lt;/P&gt;

&lt;P&gt;The documentation doesn't mention anything about it and there isn't anything in the specs for admon.conf so this might be an enhancement request but I thought I'd ask in case someone else has gotten it to work.&lt;/P&gt;

&lt;P&gt;I'm running 4.1.2 by the way. &lt;/P&gt;

&lt;P&gt;EDIT:&lt;BR /&gt;
I've confirmed that this bug is fixed in 4.1.4.  &lt;/P&gt;</description>
      <pubDate>Sat, 03 Jul 2010 00:39:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16805#M2057</guid>
      <dc:creator>erga00</dc:creator>
      <dc:date>2010-07-03T00:39:44Z</dc:date>
    </item>
    <item>
      <title>Re: Active Directory monitor not enumerating existing objects</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16806#M2058</link>
      <description>&lt;P&gt;Yes, unfortunately, this is a &lt;A href="http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues#Windows-specific_issues" rel="nofollow"&gt;bug&lt;/A&gt; in ADMonitor.  It'll be fixed in 4.1.4.&lt;/P&gt;

&lt;BLOCKQUOTE&gt;
  &lt;P&gt;ADMonitor does not index all baseline
  events (SPL-32393)&lt;/P&gt;
&lt;/BLOCKQUOTE&gt;</description>
      <pubDate>Sat, 03 Jul 2010 00:52:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16806#M2058</guid>
      <dc:creator>the_wolverine</dc:creator>
      <dc:date>2010-07-03T00:52:01Z</dc:date>
    </item>
    <item>
      <title>Re: Active Directory monitor not enumerating existing objects</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16807#M2059</link>
      <description>&lt;P&gt;Thanks. Is there an ETA on 4.1.4?&lt;/P&gt;</description>
      <pubDate>Sat, 03 Jul 2010 01:26:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Active-Directory-monitor-not-enumerating-existing-objects/m-p/16807#M2059</guid>
      <dc:creator>erga00</dc:creator>
      <dc:date>2010-07-03T01:26:12Z</dc:date>
    </item>
  </channel>
</rss>

