Security

active directory new create and delete user query

khanlarloo
Explorer

i want to show active directory created user and show deleted users.
what is the query for searching in ldapsearch ?
install windows infrastructure app,but when i create user in ad the app doesn't show the created user in users -- >new user
and also when i delete user account it doesn't show my deleted user.

0 Karma

danan5
Path Finder

Could it be the Active Directory audit policy needs to be set to log these events?

https://docs.splunk.com/Documentation/MSExchange/3.5.2/DeployMSX/ConfigureActiveDirectoryauditpolicy

0 Karma

richgalloway
SplunkTrust
SplunkTrust

LDAP search can tell you who is in AD and in which groups, but does not tell you when users are added or removed. For that, you need Windows event logs. Install the Splunk Universal Forwarder on your domain controller and enable the WinEventLog:Security input. This will send events to Splunk each time a user is added or deleted (among many other events). You can then create searches to find and display created and deleted users.

---
If this reply helps you, Karma would be appreciated.
0 Karma

khanlarloo
Explorer

can you tell me, what did you enable in group policy ?

0 Karma

khanlarloo
Explorer

i installed Splunk Universal Forwarder on my domain controller ,but when i create user on ad it doesn't show any log. even in my windows event viewer

0 Karma

dharveynswccd
Path Finder

@khanlarloo, did you enable WinEventLog:Security input on your DC as suggested by richgalloway? I also have the Splunk App for Windows Infrastructure installed and I am getting those reports. From Active Directory drop-down, go to Users>>User Reports>>Domain Accounts: New, or Domain Accounts: Deleted. Works!

0 Karma

khanlarloo
Explorer

yes,i put wineventloglog:security input on my dc, but when i create user it doesn't show any log on my app.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...