topic Re: How to search for failed logins of a specific Active Directory group? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-search-for-failed-logins-of-a-specific-Active-Directory/m-p/279526#M84450 <P>Hi,</P> <P>You should install and app to query the ldap for the members of the group that you want to filter.<BR /> <A href="https://splunkbase.splunk.com/app/1151/#/details">https://splunkbase.splunk.com/app/1151/#/details</A></P> <P>Hope i help you</P> Sat, 17 Sep 2016 17:39:11 GMT jmallorquin 2016-09-17T17:39:11Z How to search for failed logins of a specific Active Directory group? https://community.splunk.com/t5/Splunk-Search/How-to-search-for-failed-logins-of-a-specific-Active-Directory/m-p/279525#M84449 <P>Greetings. I am looking to search failed logins for a particular Active Directory group(s). I was thinking I'd have to do a subsearch based on what I've read in the forums. However, ldapsearch isn't an option due to the access I have in our managed Splunk (it's managed by a central team). So I can do a search for failed logins like so:</P> <PRE><CODE>index=[my domain controllers index] sourcetype=XmlWinEventLog:Security EventCode=4625 user!="*$" user!="SYSTEM" (LogonType=10 OR LogonType=3) </CODE></PRE> <P>However, I don't know how to search just a specific group name at the same time and report on just the failed logins for members of that group. Alternatively I could add the members of the group individually, but since the group membership would change that would be ineffective (I wouldn't always be aware of the changes).</P> <P>Does anyone have any advice?</P> Fri, 16 Sep 2016 12:57:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-failed-logins-of-a-specific-Active-Directory/m-p/279525#M84449 SplunkLunk 2016-09-16T12:57:53Z Re: How to search for failed logins of a specific Active Directory group? https://community.splunk.com/t5/Splunk-Search/How-to-search-for-failed-logins-of-a-specific-Active-Directory/m-p/279526#M84450 <P>Hi,</P> <P>You should install and app to query the ldap for the members of the group that you want to filter.<BR /> <A href="https://splunkbase.splunk.com/app/1151/#/details">https://splunkbase.splunk.com/app/1151/#/details</A></P> <P>Hope i help you</P> Sat, 17 Sep 2016 17:39:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-failed-logins-of-a-specific-Active-Directory/m-p/279526#M84450 jmallorquin 2016-09-17T17:39:11Z