Splunk report to fetch disabled AD accounts.

jatin · ‎02-23-2024

Hello experts... I need help... I want to fetch disabled AD account users... Can someone share splunk query for the same.

jatin · ‎02-23-2024

Hello @gcusello... I am not aware... I am new to Splunk... As I got this environment few days back and trying to work on my managers requirements... Please share steps or links for Add-On installation

gcusello · ‎02-23-2024

Hi @jatin,

download the app from https://splunkbase.splunk.com/app/1151 and follow the instruction at https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.8/User/AbouttheSplunkSupportingAdd-onforActi...

Ciao.

Giuseppe

gcusello · ‎02-23-2024

Hi @jatin,

have you installed the SA-LDAPSearch Add-On.

Ciao.

Giuseppe

Splunk report to fetch disabled AD accounts.

sourcetype

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

Splunk report to fetch disabled AD accounts.

sourcetype

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent