Reporting
Highlighted

How to create a report when an account is created in active directory?

New Member

Hello,

I want to have a report when an account is created in active directory?
How I can process it?

Thanks.

0 Karma
Highlighted

Re: How to create a report when an account is created in active directory?

Legend

Hi @ekoumbakemal,
see my answer in https://answers.splunk.com/answers/776027/how-to-display-a-modification-on-the-active-direct-1.html

Anyway, you have to search in Splunk the EventCode=4720:

index=wineventlog EventCode=4720
| ...

but the problem is that usually you haven't these EventCodes because this audit isn't enabled by default in Domain Controllers, so you have to enable it following instructions in my answer.

Ciao.
Giuseppe

0 Karma