All Apps and Add-ons

The SA-ldapsearch - Splunk Supporting Add-on for Active Directory does not show all users in the domain admins group.

sheaross
Explorer

I'm trying to create a report/dashboard that will show all users in the domain admins group, the query below does work and will create a report but the report is also missing users inside of the domain admins group. The users that are missing have their primary group set to domain admins.(This could be the issue) or a bug that inside of the Splunk Supporting Add-on for Active Directory. Any ideas?

| ldapsearch domain="domain" search="(&(objectclass=group)(cn=Domain Admins))"|fields *
| ldapgroup
| table member_name,member_type,member_dn
| sort member_name
| rename member_name as "Username",member_type as "Membership Type"
| search (Username !="" OR member_domain !="" OR Domain !="")

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...