Query to find Admin account's login activity

[Ravan]

Is there is any query to track all administrator and administrators group logon events on windows.

[rtadams89 · Accepted solution]

Are you trying to find local administrator logins or domain admin logins? You can search for events 528 or 4624 to find logon events, from which you could pull the username and host name. You will then need to "join" that info with some source that tells you if they are an admin or not. How you do this will depend on your environment and the answer to my first question. It could involve a join against the info pulled from Active Directory with the Splunk AD app, a join against WMI data about the local users/groups on each host, or a join against data from a script on each host that lists users/groups.

[rtadams89]

Do you have any data in any indexes currently that includes information on what users are members of what AD groups and/or what users are members of what groups on each local machine? Your first step will be gettign that data into Splunk.

[Ravan]

In this case we have both local and domain logins,
can you tell me how to join user info against WMI data on each host.