Security

Disable user account temporary

karn
Explorer

I would like to disable some local accounts temporary. I cannot find disable or suspend button in access controls settings menu. Is there a way to disable the account?

Tags (1)
0 Karma

karn
Explorer

I tried remove all rows from a target user but I cannot. It seems to need at least one role.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

There is no way to disable accounts unfortunatly.

Some suggestions:

  • Take away all their roles including user.
  • Change the passwords on the accounts (you will need to give them new passwords when you are done)
  • You could edit web.conf and use the acceptFrom parameter to limit logins only to specific IPs or a subnet

Hope this is helpful

Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...