Security

AD user account will be expired in the next 7 days

silverem78
Engager

Hi Fellows,

 

i try to have some statistics about AD user which their AD account will be expired in 7 days.

I need help because  my request doesn't work as expected;

I got the list of all user account. Do i need ldsearch instead of EventCode=4738 to get all users?

the list displyed in only 1 month after, something like the relativetie function doesnt work correctly.

index=* EventCode=4738 Account_Expires!="-"
| eval is_interesting=strptime(Account_Expires,"%m/%d/%Y")
| where is_interesting < relative_time(now(),"+7d@d")
| table user status Account_Expires is_interesting

 

Labels (2)
0 Karma

somesoni2
Revered Legend

Try this

index=* EventCode=4738 Account_Expires!="-"
| eval is_interesting=strptime(Account_Expires,"%m/%d/%Y")
| where is_interesting>now() AND is_interesting < relative_time(now(),"+7d@d")
| table user status Account_Expires is_interesting
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Isn't this something AD will do for you?

Event 4738 is for accounts that just changed.  This query will not find expiring accounts that have not changed recently.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

PickleRick
Champion

Unfortunately, no. AD on its own doesn't warn you on approaching expiries.

The client (server or workstation you log into) will warn you _upon logon_ but that's different.

If you want to catch soon-to-expire accounts, you have to run some kind of external script. But that's completely out of scope of splunk AD monitoring 🙂

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!