https://community.splunk.com/t5/Splunk-Search/Active-Directory-Group-Memberships/m-p/540708#M153004 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230897">@Inthegetto</a>&nbsp;</P><P><A href="https://splunkbase.splunk.com/app/1151/" target="_self">Splunk Supporting Add-on for Active Directory</A> includes the <A href="https://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/Theldapsearchcommand" target="_self">ldapsearch</A> command. When properly configured for your AD domain(s), you can search for users in both groups with an appropriate LDAP filter:</P><P>| ldapsearch search="(&amp;(objectCategory=person)(sAMAccountName=*)(memberOf:<SPAN>1.2.840.113556.1.4.1941:=cn=GroupA,ou=Groups,DC=example,DC=com</SPAN>)(memberOf:<SPAN>1.2.840.113556.1.4.1941:=cn=GroupB,ou=Groups,DC=example,DC=com</SPAN>))"</P><P>Running as a scheduled search, you can trigger an alert when the result count is greater than 0.</P> Sun, 21 Feb 2021 07:15:34 GMT tscroggins 2021-02-21T07:15:34Z https://community.splunk.com/t5/Splunk-Search/Active-Directory-Group-Memberships/m-p/537316#M151884 <P>I am new to splunk and trying to determine how to setup an alert when a user in active directory is in two different AD groups. For example if a user is in group A and B alert. Anyone have some direction on how to achieve this?</P> Tue, 26 Jan 2021 21:35:24 GMT https://community.splunk.com/t5/Splunk-Search/Active-Directory-Group-Memberships/m-p/537316#M151884 Inthegetto 2021-01-26T21:35:24Z https://community.splunk.com/t5/Splunk-Search/Active-Directory-Group-Memberships/m-p/540708#M153004 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230897">@Inthegetto</a>&nbsp;</P><P><A href="https://splunkbase.splunk.com/app/1151/" target="_self">Splunk Supporting Add-on for Active Directory</A> includes the <A href="https://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/Theldapsearchcommand" target="_self">ldapsearch</A> command. When properly configured for your AD domain(s), you can search for users in both groups with an appropriate LDAP filter:</P><P>| ldapsearch search="(&amp;(objectCategory=person)(sAMAccountName=*)(memberOf:<SPAN>1.2.840.113556.1.4.1941:=cn=GroupA,ou=Groups,DC=example,DC=com</SPAN>)(memberOf:<SPAN>1.2.840.113556.1.4.1941:=cn=GroupB,ou=Groups,DC=example,DC=com</SPAN>))"</P><P>Running as a scheduled search, you can trigger an alert when the result count is greater than 0.</P> Sun, 21 Feb 2021 07:15:34 GMT https://community.splunk.com/t5/Splunk-Search/Active-Directory-Group-Memberships/m-p/540708#M153004 tscroggins 2021-02-21T07:15:34Z