Capturing AD Authenticated Applications

heats — Thu, 21 Sep 2017 16:28:32 GMT

Scenario: We're doing an active directory upgrade which will effect applications that currently point to specific domain controller for authentication.

We have so many applications in use right now and some stem back to before when most of us were employed. I'm wondering if there's any way to construct something within Splunk that would be able to track applications that are authenticating via. active directory. Would it just give the servers the apps are housed on or is there a way to get specific information relating to the application itself?

I believe my first step is to get Splunk on the domain controllers, after that I'm unsure and I just wanted to see if this was something anyone on here has ever dealt with or had experience with.

As always thanks to anyone who takes the time out to read this and even more thanks if anyone has suggestions!

Re: Capturing AD Authenticated Applications

sselvaraj_splun — Tue, 03 Oct 2017 07:12:38 GMT

Hope it is possible to derive the data as requested.

Scenario: If you are collecting logs from the domain controller(DC) by using Splunk.
In general, On every single authentication task performed by any domain user, a respective Windows security event log generated.
On that case, If you search for the event ID in the 4624 and from the "Process Information" or "Process Name" column you can get the application name which got authorization from DC.

Splunk search command : host="DC1" EventCode=4624 Process_Name=*

Reference: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624#examples

topic Capturing AD Authenticated Applications in Getting Data In

Capturing AD Authenticated Applications

Re: Capturing AD Authenticated Applications