Getting Data In

User added and user removed

bshuford
Path Finder

Hello, I have an event ID 641 which is global security group modified.

This information tells me what administrator changed the security group but it doesn't tell me who was added or removed from this security group. I don't seem to even see a log of it.

Can someone tell me if there is a way to turn on more auditing so that I can log this infomration?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

View solution in original post

Oranges
Explorer

Be sure to enable Audit Account Management in your GPO for each DC in a domain or on each server for a workgroup.

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...