Feature Suggestion - Splunk Windows TA app - WMI:UserAccounts

[danielansell]

I recently enabled the WMI:UserAccounts stanza in the wmi.conf of the Windows TA app and found that the WMI:UserAccounts stanza is pulling from the Win32_Accounts class rather than the Win32_UserAccounts class. Pulling from the Win32_Accounts class pulls in all the built-in Windows classes such as "Local Accounts", "Authenticated Users", CREATOR GROUP" amongst a slew of others.

I don't know about everyone else, but I was looking specifically for the entries that show up I type "net user" at the command prompt, or view the Users directory under Local Users and Groups in computer management.

Finally, for what its worth, when using the Win32_Accounts class, I had to create an entry in my props.conf to properly extract the Name field for accounts that contained spaces.

The version of the app I'm using is 4.8.3.

[danielansell]

If anyone else is curious, I was able to simply change the WMI:UserAccounts stanza from Win32_Accounts to Win32_UserAccounts and get the results I expected.