Re: How to investigate Domain Local (DL) and Windo...

ambyadav · ‎09-05-2018

Team,

If we have Windows events and Active Directory (AD) is synced with Splunk, how can I search/investigate who modified a DL or who was added in an AD group and who added?

Is there any query? or how can I investigate this matter?

Appreciate any help.

Ambris.

richgalloway · ‎09-06-2018

There are several event codes that are generated when a group is modified. Look for 4728, 4729, 4732, 4733, 4756, or 4757.

---
If this reply helps you, Karma would be appreciated.

How to investigate Domain Local (DL) and Windows group membership?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation