Splunk report to fetch disabled AD accounts.

[jatin]

Hello experts... I need help... I want to fetch disabled AD account users... Can someone share splunk query for the same.

[jatin]

Hello @gcusello... I am not aware... I am new to Splunk... As I got this environment few days back and trying to work on my managers requirements... Please share steps or links for Add-On installation

[gcusello]

Hi @jatin,

download the app from https://splunkbase.splunk.com/app/1151 and follow the instruction at https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.8/User/AbouttheSplunkSupportingAdd-onforActi...

Ciao.

Giuseppe

[gcusello]

Hi @jatin,

have you installed the SA-LDAPSearch Add-On.

Ciao.

Giuseppe