All Apps and Add-ons

Why I am not getting any user locked out logs Eventcode =4740 from Windows AD Server ?

damode
Motivator

I am getting WinEventLog:System logs however, I am particularly not getting any logs for User Account locked out. The event code is 4740.

I have verified from the AD server that these logs were already generated and all inputs in the inputs.conf on the AD and Windows add-on of the U.F of the AD server are enabled.

I viewed the below stanza, but it doesnt looks like its causing any issue,

    [WinEventLog://Security]
    disabled = 0
    start_from = oldest
    current_only = 0
    evt_resolve_ad_obj = 1
    checkpointInterval = 5
    blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
    blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
    index = wineventlog
    renderXml=false

Can someone please guide how I can troubleshoot this issue ?

0 Karma

dstaulcu
Builder

Is the lockout event actually in the event log on the source host?

If it is, next action is to make sure the Splunk forwarder on the Source host has the the input stanza and that there are no conflicts among possibly conflicting instances of inputs.conf.

$SplunkHome$\bin\splunk cmd btool inputs list WinEventLog://Security --debug

If the input is defined and there are no conflicting whitelist or blacklist entries inherited, next action would be to make sure you are not dropping events at the receiving tier (props/transforms).

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!