topic Re: Account locked in Splunk Search

Account locked

SN1 — Fri, 20 Dec 2024 05:14:32 GMT

there is a user lets say ABC and I want to check why his AD account is locked .

Re: Account locked

ITWhisperer — Fri, 20 Dec 2024 09:43:10 GMT

What information do you have available to you to help you determine this?

Re: Account locked

SN1 — Fri, 20 Dec 2024 09:45:56 GMT

there is a user , he is saying his account is locked i want to check using splunk what is the cause how can i do that

Re: Account locked

ITWhisperer — Fri, 20 Dec 2024 10:03:27 GMT

What information do you have in Splunk? Which system is the user locked out of?

Re: Account locked

SN1 — Fri, 20 Dec 2024 10:04:40 GMT

His AD account , windows system

Re: Account locked

ITWhisperer — Fri, 20 Dec 2024 10:55:57 GMT

OK, so what information do you have in Splunk?

Re: Account locked

PickleRick — Fri, 20 Dec 2024 10:59:18 GMT

It depends on what information you have ingested into your Splunk environment.

Splunk is "just" a data processing tool. You have to feed it with data. If you have your AD logs in Splunk, you can search them but while there might be some people around here who have more experience with MS systems, it's generally more of a AD-related question how to find that info than it is a Splunk Question. You must know what to look for.

If your data is properly onboarded and CIM-compliant, you can look through Change datamodel (if I remember the syntax correctly)

| datamodel Change Account_Management.Locked_Accounts | search user="whatever"

I'm not sure though if it will only find the lockout event as such or will it contain the reason as well.