How to investigate Domain Local (DL) and Windows g...

ambyadav · ‎09-05-2018

Team,

If we have Windows events and Active Directory (AD) is synced with Splunk, how can I search/investigate who modified a DL or who was added in an AD group and who added?

Is there any query? or how can I investigate this matter?

Appreciate any help.

Ambris.

richgalloway · ‎09-06-2018

There are several event codes that are generated when a group is modified. Look for 4728, 4729, 4732, 4733, 4756, or 4757.

---
If this reply helps you, Karma would be appreciated.

How to investigate Domain Local (DL) and Windows group membership?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Join the Conversation