topic How do you search for windows username and login failure? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-you-search-for-windows-username-and-login-failure/m-p/128684#M26416 <P>I need to be able to quickly report on, and identify AD/windows user account login failures...and to be able to find the source IP of the host locking the account out.</P> Wed, 27 May 2015 18:48:05 GMT michaelnaples 2015-05-27T18:48:05Z How do you search for windows username and login failure? https://community.splunk.com/t5/Getting-Data-In/How-do-you-search-for-windows-username-and-login-failure/m-p/128684#M26416 <P>I need to be able to quickly report on, and identify AD/windows user account login failures...and to be able to find the source IP of the host locking the account out.</P> Wed, 27 May 2015 18:48:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-search-for-windows-username-and-login-failure/m-p/128684#M26416 michaelnaples 2015-05-27T18:48:05Z Re: How do you search for windows username and login failure? https://community.splunk.com/t5/Getting-Data-In/How-do-you-search-for-windows-username-and-login-failure/m-p/128685#M26417 <P>Might be overkill, but check out the Splunk App for Windows Infrastructure ( <A href="https://splunkbase.splunk.com/app/1680/">https://splunkbase.splunk.com/app/1680/</A> )</P> <P><A href="http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/ADAdministratorAudit">http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/ADAdministratorAudit</A><BR /> <A href="http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/FailedLogons">http://docs.splunk.com/Documentation/MSApp/1.1.3/Reference/FailedLogons</A></P> Wed, 27 May 2015 19:54:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-search-for-windows-username-and-login-failure/m-p/128685#M26417 mgildenhorn_spl 2015-05-27T19:54:42Z