topic Re: Collecting logon/logoff logs from Active Directory in Getting Data In

Collecting logon/logoff logs from Active Directory

Djow — Fri, 13 Jan 2017 10:06:38 GMT

Hi,
I am trying to get the Windows Infrastructure all configured. For the most part I think I have it configured right but something are not working. I would like to collect logon/logoff logs from AD.

I follow the docs about Windows Apps Infra and put Add-ons on my Splunkforwarder ( AD domain ) etc

Domains, domain controllers, Group policy and Organizational Units are found but DNS, Users and Groups are not found.

Any help to get this working would be appreciated.

Excuse my English

Thanks
Geoffrey

Re: Collecting logon/logoff logs from Active Directory

tfellinger — Fri, 13 Jan 2017 14:28:39 GMT

When you say "DNS, Users and Groups" are not found, what do you mean exactly by that?
Did you activate a GPO to audit Logon/Logoff events?

Re: Collecting logon/logoff logs from Active Directory

Djow — Fri, 13 Jan 2017 15:16:32 GMT

On the installation for Windows Infrastructure , After checking data, the App detects features to collect and then disable DNS, Users, Computers and Groups
However, on the Eventviewer on my Windows(AD controller and domain) and on Splunk research , i see the " Event ID 4624" that correspond to logon/logoff.
GPO to audit Audit account logon events, account management, logon events and Powershell are activated.

Re: Collecting logon/logoff logs from Active Directory

gcusello — Tue, 29 Sep 2020 12:26:51 GMT

Hi Djow,
Collecting logon/logoff from Windows is difficult because every access generates 10-12 events and there are many automatic accesses of services, so it's difficult to display the real accesses to systems.
I filtered taking

Login EventCode=4624 OR EventCode=524
Logfail EventCode=4625 OR EventCode=529
Logout EventCode=4647 OR EventCode=551 and
Logon_Type=2 OR Logon_Type=10) and making dedup for _time User host

Instead to have the active sessions I used a simple script for systems greater than 2008 seven:

@echo off
REM --------------------------------------
REM Controllo delle sessioni utente attive
REM --------------------------------------

REM Get event date and time
set date_time=%date% %time%

REM Print the event date and time, this will be the event timestamp
echo Current time: %date_time%

REM print the current user session
query user

Bye.
Giuseppe

Re: Collecting logon/logoff logs from Active Directory

Djow — Tue, 17 Jan 2017 14:08:24 GMT

I found something about logs, i use Windows Server 2012 R2 in french and dashboards on Windows Infrastructure App don't read french logs so it didn't work.
Is there a way to resolve this ?

Thanks

Geoffrey