AD user account will be expired in the next 7 days

[silverem78]

Hi Fellows,

i try to have some statistics about AD user which their AD account will be expired in 7 days.

I need help because  my request doesn't work as expected;

I got the list of all user account. Do i need ldsearch instead of EventCode=4738 to get all users?

the list displyed in only 1 month after, something like the relativetie function doesnt work correctly.

index=* EventCode=4738 Account_Expires!="-"
| eval is_interesting=strptime(Account_Expires,"%m/%d/%Y")
| where is_interesting < relative_time(now(),"+7d@d")
| table user status Account_Expires is_interesting

[somesoni2]

Try this

index=* EventCode=4738 Account_Expires!="-"
| eval is_interesting=strptime(Account_Expires,"%m/%d/%Y")
| where is_interesting>now() AND is_interesting < relative_time(now(),"+7d@d")
| table user status Account_Expires is_interesting

[richgalloway]

Isn't this something AD will do for you?

Event 4738 is for accounts that just changed.  This query will not find expiring accounts that have not changed recently.

[PickleRick]

Unfortunately, no. AD on its own doesn't warn you on approaching expiries.

The client (server or workstation you log into) will warn you _upon logon_ but that's different.

If you want to catch soon-to-expire accounts, you have to run some kind of external script. But that's completely out of scope of splunk AD monitoring 🙂