Getting Data In

User added and user removed

bshuford
Path Finder

Hello, I have an event ID 641 which is global security group modified.

This information tells me what administrator changed the security group but it doesn't tell me who was added or removed from this security group. I don't seem to even see a log of it.

Can someone tell me if there is a way to turn on more auditing so that I can log this infomration?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

View solution in original post

Oranges
Explorer

Be sure to enable Audit Account Management in your GPO for each DC in a domain or on each server for a workgroup.

Ron_Naken
Splunk Employee
Splunk Employee

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...