Splunk Support for Active Directory: How to find all computers in AD and list those that are not sending logs to Splunk?

[mcbradford]

We have the ldapsearch app installed. I would like to query AD and get a list of all the "ACTIVE" computers that match an OU, then see if these systems are sending logs to Splunk.

Thoughts???

[ahall_splunk]

Would this blog post assist? http://blogs.splunk.com/2013/05/09/are-all-my-microsoft-servers-being-splunked/

[ibondarets]

this one:

ldapsearch domain=SHELL search="(&(operatingSystem=Server)(objectCategory=computer))" attrs="CN,operatingSystem"

doesn't work by default ad requires changes to AD Forest replication.
This is because "Splunk Support for Active Directory" uses only Global Catalog requests and cannot perform regular LDAP requests for some reason.