Security

Query to find Admin account's login activity

Path Finder

Is there is any query to track all administrator and administrators group logon events on windows.

Tags (2)
0 Karma
1 Solution

Contributor

Are you trying to find local administrator logins or domain admin logins? You can search for events 528 or 4624 to find logon events, from which you could pull the username and host name. You will then need to "join" that info with some source that tells you if they are an admin or not. How you do this will depend on your environment and the answer to my first question. It could involve a join against the info pulled from Active Directory with the Splunk AD app, a join against WMI data about the local users/groups on each host, or a join against data from a script on each host that lists users/groups.

View solution in original post

0 Karma

Contributor

Are you trying to find local administrator logins or domain admin logins? You can search for events 528 or 4624 to find logon events, from which you could pull the username and host name. You will then need to "join" that info with some source that tells you if they are an admin or not. How you do this will depend on your environment and the answer to my first question. It could involve a join against the info pulled from Active Directory with the Splunk AD app, a join against WMI data about the local users/groups on each host, or a join against data from a script on each host that lists users/groups.

View solution in original post

0 Karma

Contributor

Do you have any data in any indexes currently that includes information on what users are members of what AD groups and/or what users are members of what groups on each local machine? Your first step will be gettign that data into Splunk.

0 Karma

Path Finder

In this case we have both local and domain logins,
can you tell me how to join user info against WMI data on each host.

0 Karma