Security

How can I exclude disabled Active Directory user accounts from Splunk?

Chubbybunny
Splunk Employee
Splunk Employee

When a user leaves the company, our IT department has a strict policy in place to deactivate the UserAccount instead of deleting it from the AD. This actually leaves a hole for us because Splunk will continue to sync the account as it does not understand the account has been deactivated within our AD.

While this Answer post seems to fit my situation, I'd prefer to NOT hide the account, and just ignore it.

Anyone know of a workaround to have Splunk ignore disabled accounts??

1 Solution

acharlieh
Influencer

I'll readily admit that I haven't done such in Splunk, but I've used LDAP queries to find disabled accounts. In Splunk you would modify the user base filter, to include a match that the appropriate bit(s) in the userAccountControl attribute are set or not set.

This site seems to have an excellent guide to all of the bits that are encoded in the userAccountControl attribute. They also have a guide to the bitwise ldap filters

Edit: Maybe a filter like:

(&
    (objectClass=user)
    (userAccountControl:1.2.840.113556.1.4.803:=512)
    (!
        (userAccountControl:1.2.840.113556.1.4.803:=2)
    )
)

A user, who is a normal user and not a computer or something, where the account disable bit is not set. One line for easy copying:

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

I have used it. Say I have two users in AD with attributes like

AD User/account 'Rbal' has accountExpires=08/9/2015
and user 'Bill Paul' with accountExpires=never

In Splunk Configured "User base filter" as

User base filter” as (accountExpires=9223372036854775807) ( where 9223372036854775807 is for never)

Now if I check under Access controls » Users found user 'Bill Paul' is filtered.

0 Karma

yungro
Explorer

To configure Splunk to ignore inactive account, simply add the userAccountControl as follow in the "User base filter" field:

(&(objectCategory=Person)(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

acharlieh
Influencer

I'll readily admit that I haven't done such in Splunk, but I've used LDAP queries to find disabled accounts. In Splunk you would modify the user base filter, to include a match that the appropriate bit(s) in the userAccountControl attribute are set or not set.

This site seems to have an excellent guide to all of the bits that are encoded in the userAccountControl attribute. They also have a guide to the bitwise ldap filters

Edit: Maybe a filter like:

(&
    (objectClass=user)
    (userAccountControl:1.2.840.113556.1.4.803:=512)
    (!
        (userAccountControl:1.2.840.113556.1.4.803:=2)
    )
)

A user, who is a normal user and not a computer or something, where the account disable bit is not set. One line for easy copying:

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...