Splunk App for Windows Infrastructure: What are the parameters for UNUSED user accounts report?

[grambo271]

Greetings,
I am using the Splunk App for Windows Infrastructure. In the Active Directory portion there is a report specifically for UNUSED user accounts (Active Directory\Users\User Reports\Unused). I was wondering if anyone happens to know what the variable is on that report to denote an unused account? Is it that the user has not logged in within 30 days, 90 days, 6 months or ever? I'd like to initiate cleanup of these accounts but want to make sure I have all the right information/understanding.

Thanks in advance

[malmoore]

The Windows Infrastructure app defines an "Unused user account" as an account whose logon count is 0, meaning that they have never logged on.

The search against the domain happens when you load the page and select the desired domain (which should be present if you've configured the app correctly.)

[darlas]

Thanks malmoore.

To clarify then how this works: does the app has a list of users and looks for the existence of Windows login events for those users. If none found for a given user then they are considered an "Unused user account". Where does this list of users come from? How can I see what list of users is being used? (Professional Services set this up for us so I am missing some of the details 😞 )

Or does the app look at some attribute in AD, like lastLogon, for all users to see which users do NOT have a value in the attribute?

Thanks for helping me understand!

[darlas]

I'd be interested in knowing this as well 🙂