Getting Data In

User added and user removed

bshuford
Path Finder

Hello, I have an event ID 641 which is global security group modified.

This information tells me what administrator changed the security group but it doesn't tell me who was added or removed from this security group. I don't seem to even see a log of it.

Can someone tell me if there is a way to turn on more auditing so that I can log this infomration?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

View solution in original post

Oranges
Explorer

Be sure to enable Audit Account Management in your GPO for each DC in a domain or on each server for a workgroup.

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...