Getting Data In

AD Schema - Inaccurate in v6 for pwdLastSet badPasswordTime lastLogon lastLogonTimestamp

Splunk Employee
Splunk Employee

Issue is using 'admon' input on Windows with Splunk 6.x some of the key column for AD Schema are wrong, this seems like a regression as it worked on Splunk Version 5.x.
The attributes like pwdLastSet,badPasswordTime,lastLogon,lastLogonTimestamp,whenChanged – all have the same exact time stamp

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

This behavior has been confirmed as Bug between Splunk Version 6.x and current release 6.0.3. It is expected to be fixed in Splunk Release 6.0.5. Bug Number

SPL-83047:ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not being retrieved accurately from the AD record

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

This behavior has been confirmed as Bug between Splunk Version 6.x and current release 6.0.3. It is expected to be fixed in Splunk Release 6.0.5. Bug Number

SPL-83047:ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not being retrieved accurately from the AD record

View solution in original post

0 Karma

Explorer

I'm still seeing this behavior in Splunk 6.0.6 build 228831 and SplunkforActiveDirectory 1.2.2

0 Karma

Motivator

any idea of the ETA of fixing this? does this affect ldapsearch or enterprise security?

0 Karma