topic Need last logon for a user in Splunk Search

Need last logon for a user

chrodriguez — Fri, 06 Nov 2020 14:47:57 GMT

Need to know what was the last time a domain AD account “username” was logged into and from what server/machine please?

Re: Need last logon for a user

nwuest — Fri, 06 Nov 2020 15:09:26 GMT

Hi @chrodriguez

Try this:

EventCode=4624 | dedup ComputerName | table ComputerName _time

View solution in original post

Let us know if this works for you

V/R,
nwuest

Re: Need last logon for a user

chrodriguez — Fri, 06 Nov 2020 15:45:39 GMT

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin")
| eval day=strftime(_time,"%d/%m/%Y")
| stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

Re: Need last logon for a user

chrodriguez — Fri, 06 Nov 2020 16:52:59 GMT

That doesn't return anything, I really need to focus on "A User" not just everything. I ran this, and it returned nothing for the account but then when I try against my user account it does return data. The account wmsadmin is indeed an actual user account that is disabled and the "lastLogonTimestamp" has a value or date of 9/20/2011. index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin") | eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day | eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

Re: Need last logon for a user

nwuest — Fri, 06 Nov 2020 17:25:07 GMT

Hi @chrodriguez,

So you are specifically looking for the account "wmsadmin", which is disabled to see the last time that it was used to log in?

Have you been collecting logs in your environment with splunk forwarders since "9/20/2011" the date of the lastLogonTimestamp?

If you have had splunk forwarders collecting events for that long, what is your retention policy with frozen buckets?
If not, you can try to kickoff an event with 'enabling that account, logging in-and-out with it then disabling the account'.
Then you should see some activity in your searchhead so that search will return some results.

Let us know what happens!

V/R,
nwuest

Re: Need last logon for a user

chrodriguez — Fri, 06 Nov 2020 18:17:36 GMT

thanks for the insight, I completely forgot that we have only had splunk introduced since 2016. So thats why its not populating data from 2011.