This is not a question, but information sharing about using the "Splunk Supporting Add-on for Active Directory", to generate a report on all AD user accounts in your Windows domain, their creation, logon, and last logon dates, whether the account is still active, and how many days since the account was last logged in.
We generate the report every month to check for old accounts which have not been deactivated properly when employee or service accounts are no longer needed / used. Good security check to review accounts which have been inactive and possible candidates to deactivate, to minimise potential exploitation.
Thank you, this is very helpful. I have 6 DC in my environment and only 1 is configured in Splunk for LDAP. Considering the inconsistency of Last login time across the DCs, is there a way to include other DCs as well ?