How to create a search Disable user to search the list of users whose account was disabled?

[RJ2]

hello there i want to search the list of users whose account was disabled with their Account name  and make it as report

[gcusello]

Hi @RJ2,

at first you need to find the EventCode related to disabled users

• 629
• 4725

and the run a simple search like this:

index=wineventlog EventCode IN (629,4725)
| table _time Account_name host

Ciao.

Giuseppe