https://community.splunk.com/t5/Splunk-Search/Use-Case-sAMAccountName-changes-in-domain-controller/m-p/579475#M201927 <P>Windows event 4738 should tell you if the account name changed.&nbsp; Look for&nbsp;<SPAN>SAM_Account_Name under Changed_Attributes.</SPAN></P> Wed, 29 Dec 2021 14:34:59 GMT richgalloway 2021-12-29T14:34:59Z https://community.splunk.com/t5/Splunk-Search/Use-Case-sAMAccountName-changes-in-domain-controller/m-p/579444#M201916 <P>Hi,</P><P>want to create a search to find anyone who does changes to the&nbsp;sAMAccountName&nbsp;</P><P>So&nbsp;<SPAN class=""><SPAN class="">sAMAccountName could be&nbsp;sAMAccountName<SPAN>=</SPAN>cdf or&nbsp;sAMAccountName<SPAN>=</SPAN>abc </SPAN></SPAN></P><P><SPAN class=""><SPAN class="">sAMAccountName</SPAN></SPAN><SPAN>=</SPAN><SPAN class="">abc&nbsp; if anyone changes this to&nbsp;<SPAN class="">sAMAccountName</SPAN><SPAN>=</SPAN>abc1 triggers an alert.&nbsp;</SPAN></P><P>&nbsp;</P><P>&nbsp;</P> Wed, 29 Dec 2021 09:37:48 GMT https://community.splunk.com/t5/Splunk-Search/Use-Case-sAMAccountName-changes-in-domain-controller/m-p/579444#M201916 shanaz 2021-12-29T09:37:48Z https://community.splunk.com/t5/Splunk-Search/Use-Case-sAMAccountName-changes-in-domain-controller/m-p/579475#M201927 <P>Windows event 4738 should tell you if the account name changed.&nbsp; Look for&nbsp;<SPAN>SAM_Account_Name under Changed_Attributes.</SPAN></P> Wed, 29 Dec 2021 14:34:59 GMT https://community.splunk.com/t5/Splunk-Search/Use-Case-sAMAccountName-changes-in-domain-controller/m-p/579475#M201927 richgalloway 2021-12-29T14:34:59Z