https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-know-the-Account-name-when-the-Local-or-Global/m-p/48615#M9222 <P>check the event description 4732: <A href="https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4732" target="_blank">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4732</A><BR /> the Account Name is extracted but if you dont use the windows TA you will have to use eval on the Account_Name field as it contains 2 values, 1 for the account who made the change and one for the member of the group.<BR /> when using the Windows TA, splunk extracts the fields src_user and user accordingly</P> Tue, 29 Sep 2020 14:03:56 GMT adonio 2020-09-29T14:03:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-know-the-Account-name-when-the-Local-or-Global/m-p/48614#M9221 <P>Hi all,</P> <P>I found a problem when I migrate Splunk from Windows server 2003 to Windows server 2008.<BR /><BR /> I created a alert for local or global groups changed. <BR /> It works well in Windows server 2003. But in Windows Server 2008, there is only Sid, no Account Name. Here is an example. If I add myslf into the administrator group. (I have changd some real information....) Thank you in advance!</P> <P>In windows server 2003:</P> <P>SourceName=Security<BR /> EventCode=636<BR /> Type=Success Audit</P> <P>......</P> <P>......</P> <P>Message=Security Enabled Local Group Member Added:<BR /><BR /> Member Name: -<BR /><BR /> Member ID: AP\zyxcc<BR /><BR /> Target Account Name: Administrators<BR /><BR /> Target Domain: Builtin <BR /> Target Account ID: AP\Administrators<BR /><BR /> Caller User Name: zyxcc<BR /><BR /> Caller Domain: AP<BR /><BR /> ......</P> <P>But in windows server 2008, there has Sid, but no account name for the member's information:</P> <P>SourceName=Microsoft Windows security auditing.<BR /> EventCode=4732</P> <P>......</P> <P>......</P> <P>Keywords=Audit Success</P> <P>Message=A member was added to a security-enabled local group.</P> <P>Subject:<BR /><BR /> Security ID: S-1-5-21-981343549-14154652-165423545<BR /><BR /> Account Name: zyxcc<BR /><BR /> Account Domain: AP<BR /><BR /> Logon ID: 0x51ed123</P> <P>Member: </P> <P>Security ID: S-1-5-21-981343549-14154652-165423545<BR /><BR /> Account Name: -</P> <P>Group:<BR /><BR /> Security ID: BUILT\Administrators<BR /><BR /> Group Name: Administrators<BR /><BR /> Group Domain: Built</P> <P>......</P> Thu, 29 Nov 2012 08:01:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-know-the-Account-name-when-the-Local-or-Global/m-p/48614#M9221 zyxcc 2012-11-29T08:01:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-know-the-Account-name-when-the-Local-or-Global/m-p/48615#M9222 <P>check the event description 4732: <A href="https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4732" target="_blank">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4732</A><BR /> the Account Name is extracted but if you dont use the windows TA you will have to use eval on the Account_Name field as it contains 2 values, 1 for the account who made the change and one for the member of the group.<BR /> when using the Windows TA, splunk extracts the fields src_user and user accordingly</P> Tue, 29 Sep 2020 14:03:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-know-the-Account-name-when-the-Local-or-Global/m-p/48615#M9222 adonio 2020-09-29T14:03:56Z