All Apps and Add-ons

Issues with Splunk App for AD and Group policy changes not being listed

coleman07
Path Finder

The group policy audit does not show changes made to gpo's. I have two domain controllers in a forest, one serving the root domain and the other serving a subdomain. The Splunk App for AD uses event 4662 which has embedded an Object Type and Object Name which is used in the following search macro:

eventtype=msad-ad-access Object_Type="groupPolicyContainer" | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | stats count values(Object_Name) by host

On one domain controller, the Object Type is properly stored on the indexer as groupPolicyContainer thus this search works properly. The Object Name is also correct. The other domain controller is sending just hex codes for the Object Type and Object Name, ie instead of the following entry

Object Type: groupPolicyContainer
Object Name: CN={135A1F9B-BECD-40CB-AA3E-FE24D39269A9}CN=Policies,CN=System,DC=na,DC=globomantics,DC=local

Instead it looks as follow:

Object Type:        %{19195a5b-6da0-11d0-afd3-00c04fd930c9}
Object Name:        %{b180120c-b7b5-4e90-bbe8-9def8d9492db}

This issue is very similar to a question asked "Splunk for AD - Group Policy Changes Query

I am reasking the question because I wonder if I have misconfigured the windows server resulting in just hex being sent to the indexer and not a bug in the AD app.

0 Karma

jbernt_splunk
Splunk Employee
Splunk Employee

One possible fix, on the domain controllers, temporarily switch the user that the universal forwarder runs as, to a domain user (domain\user1, for example), restart Splunk, let it run for a few minutes, reset the user that Splunk runs as back to Local System and you should start seeing the Splunk_TA_windows ADMon stanza start showing. Also, in the Splunk_TA_windows/local/inputs.conf, make sure that you set ADMon to enabled. In WinEventLog://Security, make sure you set evt_resolve_ad_obj=1, so the GUIDs get translated in Splunk.

0 Karma

jvargas80
Explorer

I'm having the same issue on a 2008 R2 domain. Running 2 DCs and 2008 R2 functional level. I'm getting hex values for the same two fields. Were you able to find a fix?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...