https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151470#M30804 <P>This behavior has been confirmed as Bug between Splunk Version 6.x and current release 6.0.3. It is expected to be fixed in Splunk Release 6.0.5. Bug Number </P> <P>SPL-83047:ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not being retrieved accurately from the AD record </P> Sun, 04 May 2014 05:26:27 GMT rbal_splunk 2014-05-04T05:26:27Z https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151469#M30803 <P>Issue is using 'admon' input on Windows with Splunk 6.x some of the key column for AD Schema are wrong, this seems like a regression as it worked on Splunk Version 5.x.<BR /> The attributes like pwdLastSet,badPasswordTime,lastLogon,lastLogonTimestamp,whenChanged – all have the same exact time stamp </P> Sun, 04 May 2014 05:14:56 GMT https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151469#M30803 rbal_splunk 2014-05-04T05:14:56Z https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151470#M30804 <P>This behavior has been confirmed as Bug between Splunk Version 6.x and current release 6.0.3. It is expected to be fixed in Splunk Release 6.0.5. Bug Number </P> <P>SPL-83047:ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not being retrieved accurately from the AD record </P> Sun, 04 May 2014 05:26:27 GMT https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151470#M30804 rbal_splunk 2014-05-04T05:26:27Z https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151471#M30805 <P>any idea of the ETA of fixing this? does this affect ldapsearch or enterprise security?</P> Mon, 05 May 2014 13:43:05 GMT https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151471#M30805 aelliott 2014-05-05T13:43:05Z https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151472#M30806 <P>I'm still seeing this behavior in Splunk 6.0.6 build 228831 and Splunk_for_ActiveDirectory 1.2.2</P> Mon, 28 Sep 2020 17:59:48 GMT https://community.splunk.com/t5/Getting-Data-In/AD-Schema-Inaccurate-in-v6-for-pwdLastSet-badPasswordTime/m-p/151472#M30806 dale_lakes8769 2020-09-28T17:59:48Z