All Apps and Add-ons

Splunk App for Windows Infrastructure: What are the parameters for UNUSED user accounts report?

grambo271
Explorer

Greetings,
I am using the Splunk App for Windows Infrastructure. In the Active Directory portion there is a report specifically for UNUSED user accounts (Active Directory\Users\User Reports\Unused). I was wondering if anyone happens to know what the variable is on that report to denote an unused account? Is it that the user has not logged in within 30 days, 90 days, 6 months or ever? I'd like to initiate cleanup of these accounts but want to make sure I have all the right information/understanding.

Thanks in advance

0 Karma

malmoore
Splunk Employee
Splunk Employee

The Windows Infrastructure app defines an "Unused user account" as an account whose logon count is 0, meaning that they have never logged on.

The search against the domain happens when you load the page and select the desired domain (which should be present if you've configured the app correctly.)

0 Karma

darlas
Communicator

Thanks malmoore.

To clarify then how this works: does the app has a list of users and looks for the existence of Windows login events for those users. If none found for a given user then they are considered an "Unused user account". Where does this list of users come from? How can I see what list of users is being used? (Professional Services set this up for us so I am missing some of the details 😞 )

Or does the app look at some attribute in AD, like lastLogon, for all users to see which users do NOT have a value in the attribute?

Thanks for helping me understand!

0 Karma

darlas
Communicator

I'd be interested in knowing this as well 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...