Active Directory Lockout alerts

[jared_anderson]

I have active directory sending logs to my Splunk server via a Universal forwarder. I want to create alerts for when a user locks themselves out of Active Directory. What is the best way to do this?

[jan_wohlers]

EventCode=4740 host=* --> This will show you all lock out events occuring. "Caller Name" ist the server/System from where the lockout comes from

[jared_anderson]

I think the problem I have is that we have multiple domain controllers, and the forwarder isn't on the main one. So I don't get the actual lockout event, just the replication across the DCs

[mbenwell]

Look at the Active Directory App. As part of this app you will get all sorts of field extractions, dashboards and eventtypes (including one for account lockouts).

So... then just search for the eventtype:

eventtype=msad-account-lockout

[stephennbh]

How could I run this search against my whole domain for all the domain controllers instead of one DC host?

[kristian_kolb]

Assuming that you have the security log in splunk, the following search would probably work

sourcetype=wineventlog:security host=<your domain controller> Failure_Reason="Account locked out." | eval acc=mvindex(Account_Name,1)| table _time acc 

This gives you a list of anyone trying to log in with a locked account. Set up a scheduled search, and report when number of results is > 0.

Hope this helps,

Kristian

[kristian_kolb]

Hmm, yes, I think that this event will be generated the when the account gets locked as well.

[jared_anderson]

would this only work if they tried to log in when they were already locked out? If they locked the account out, then never tried to log in again, would this report find anything?