All Apps and Add-ons

Splunk App for Windows Infrastructure: What are the parameters for UNUSED user accounts report?

grambo271
Explorer

Greetings,
I am using the Splunk App for Windows Infrastructure. In the Active Directory portion there is a report specifically for UNUSED user accounts (Active Directory\Users\User Reports\Unused). I was wondering if anyone happens to know what the variable is on that report to denote an unused account? Is it that the user has not logged in within 30 days, 90 days, 6 months or ever? I'd like to initiate cleanup of these accounts but want to make sure I have all the right information/understanding.

Thanks in advance

0 Karma

malmoore
Splunk Employee
Splunk Employee

The Windows Infrastructure app defines an "Unused user account" as an account whose logon count is 0, meaning that they have never logged on.

The search against the domain happens when you load the page and select the desired domain (which should be present if you've configured the app correctly.)

0 Karma

darlas
Communicator

Thanks malmoore.

To clarify then how this works: does the app has a list of users and looks for the existence of Windows login events for those users. If none found for a given user then they are considered an "Unused user account". Where does this list of users come from? How can I see what list of users is being used? (Professional Services set this up for us so I am missing some of the details 😞 )

Or does the app look at some attribute in AD, like lastLogon, for all users to see which users do NOT have a value in the attribute?

Thanks for helping me understand!

0 Karma

darlas
Communicator

I'd be interested in knowing this as well 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...