topic Re: Active Directory - Finding if an account is enabled in Splunk Search

Active Directory - Finding if an account is enabled

kholleran — Tue, 31 Aug 2010 21:44:41 GMT

Hello,

I am monitoring Active Directory with Splunk and have two questions:

1.) How do I format time in a search? I need to report on a specific user sets last logon time but it keeps returning in msecs (?). How can I do in search time formatting? I am actually having this issue across a couple searches and not just with the AD LastLogon.

2.) Is there a way to find the status of a specific user account? We have vendor accounts that a third party can use to get into some systems that they service, however, the accounts are disabled until they contact a proper person to enable them. I would like to run a report and return the status of the accounts every morning or list the accounts that are enabled. Is there a way to glean this from the AD data that Splunk monitors?

Thanks for your time and help.

Kevin

Re: Active Directory - Finding if an account is enabled

gkanapathy — Tue, 31 Aug 2010 22:16:54 GMT

The time format is possibly in Microsoft Ticks (and if you post examples we can verify), which you can convert with:

... | eval epochlogintime = (logintime-621355968000000000)/10000000
    | eval readabletime = strptime(epochlogintime,"%y-%m-%d %H:%M:%S)

As for the second question, you probably need to look at the AD field userAccountControl. This field is a bitmask field. We don't have bitwise operations in Splunk search language, but the disabled bit is 0x2 (or bit 2), so you can do:

... | eval isDisabled = if((userAccountControl%4)>=2),"disabled","enabled")

Re: Active Directory - Finding if an account is enabled

bojanz — Wed, 01 Sep 2010 01:46:23 GMT

Is there a reason why you don't pull this data out of Event logs instead of monitoring AD?

In Event logs, you will easily see when the user logged in last time. Regarding enabled accounts, check EventCode 626 on Windows 2003 or EventCode 4722 on Windows 2008. Splunk will automatically extract these Event codes, so a search such as this one:

index=windows EventCode=626 OR EventCode=4722

will print all enabled accounts.

Re: Active Directory - Finding if an account is enabled

insomniacnerd94 — Wed, 07 Aug 2019 18:53:11 GMT

You forgot another opening parenthesis:

your base search ... | eval isDisabled = if(((userAccountControl%4)>=2),"disabled","enabled")