active directory new create and delete user query

[khanlarloo]

i want to show active directory created user and show deleted users.
what is the query for searching in ldapsearch ?
install windows infrastructure app,but when i create user in ad the app doesn't show the created user in users -- >new user
and also when i delete user account it doesn't show my deleted user.

[danan5]

Could it be the Active Directory audit policy needs to be set to log these events?

https://docs.splunk.com/Documentation/MSExchange/3.5.2/DeployMSX/ConfigureActiveDirectoryauditpolicy

[richgalloway]

LDAP search can tell you who is in AD and in which groups, but does not tell you when users are added or removed. For that, you need Windows event logs. Install the Splunk Universal Forwarder on your domain controller and enable the WinEventLog:Security input. This will send events to Splunk each time a user is added or deleted (among many other events). You can then create searches to find and display created and deleted users.

[khanlarloo]

can you tell me, what did you enable in group policy ?

[khanlarloo]

i installed Splunk Universal Forwarder on my domain controller ,but when i create user on ad it doesn't show any log. even in my windows event viewer

[dharveynswccd]

@khanlarloo, did you enable WinEventLog:Security input on your DC as suggested by richgalloway? I also have the Splunk App for Windows Infrastructure installed and I am getting those reports. From Active Directory drop-down, go to Users>>User Reports>>Domain Accounts: New, or Domain Accounts: Deleted. Works!

[khanlarloo]

yes,i put wineventloglog:security input on my dc, but when i create user it doesn't show any log on my app.