https://community.splunk.com/t5/Getting-Data-In/Active-Directory/m-p/102480#M21496 <P>Can´t find the event when I delete a user in AD.<BR /> Is there any special config to get this info?<BR /> Using Splunk 4.3 on windows 2008 R2 server</P> Wed, 18 Jul 2012 18:40:22 GMT renatac 2012-07-18T18:40:22Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory/m-p/102480#M21496 <P>Can´t find the event when I delete a user in AD.<BR /> Is there any special config to get this info?<BR /> Using Splunk 4.3 on windows 2008 R2 server</P> Wed, 18 Jul 2012 18:40:22 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory/m-p/102480#M21496 renatac 2012-07-18T18:40:22Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory/m-p/102481#M21497 <P>You can get this information by using the splunk-admon.exe data input. Check out <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory">http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory</A></P> Thu, 19 Jul 2012 00:00:26 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory/m-p/102481#M21497 ahall_splunk 2012-07-19T00:00:26Z