https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/601552#M209354 <P>How long back are you looking to detect when an account was disabled?</P><P>I've found a query that may suit your needs<BR /><BR /></P><LI-CODE lang="markup">EventCode=4725 OR EventCode=4722 earliest=-60d |eval account=mvindex(Account_Name,1) |stats values(_time) as times, earliest(EventCode) as firstEvent, latest(EventCode) as lastEvent by account |replace "4722" with "enabled" in firstEvent, lastEvent |replace "4725" with "disabled" in firstEvent, lastEvent |search account != "*\$" AND firstEvent != "enabled" AND lastEvent != "disabled" |convert ctime(times) |table times, firstEvent, lastEvent, account</LI-CODE><P>&nbsp;</P> Mon, 13 Jun 2022 13:43:27 GMT Stefanie 2022-06-13T13:43:27Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/601371#M209296 <P>Does anyone have experience writing a query that can be used to alert on disabled AD accounts being re-enabled? I've learned that Windows EventCode 4722 can be used to find accounts being enabled, but I'm unsure of how to correlate that with whether or not the account was in a disabled state beforehand.</P> <P>&nbsp;</P> Fri, 10 Jun 2022 15:30:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/601371#M209296 eblackburn 2022-06-10T15:30:32Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/601552#M209354 <P>How long back are you looking to detect when an account was disabled?</P><P>I've found a query that may suit your needs<BR /><BR /></P><LI-CODE lang="markup">EventCode=4725 OR EventCode=4722 earliest=-60d |eval account=mvindex(Account_Name,1) |stats values(_time) as times, earliest(EventCode) as firstEvent, latest(EventCode) as lastEvent by account |replace "4722" with "enabled" in firstEvent, lastEvent |replace "4725" with "disabled" in firstEvent, lastEvent |search account != "*\$" AND firstEvent != "enabled" AND lastEvent != "disabled" |convert ctime(times) |table times, firstEvent, lastEvent, account</LI-CODE><P>&nbsp;</P> Mon, 13 Jun 2022 13:43:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/601552#M209354 Stefanie 2022-06-13T13:43:27Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/602285#M209640 <P>That's really helpful. Thanks!</P> Fri, 17 Jun 2022 19:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-Alert-on-disabled-AD-accounts-being-re-enabled/m-p/602285#M209640 eblackburn 2022-06-17T19:58:53Z