splunk SPL for who disable user AD account ?

[merajhussain]

Just wanted to know Ad account activity who is disable the AD user account ?

[nickhills]

You are looking for windows event id 4725 (2k8+ or 629 on 2k3)
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4725

TargetUserName is the disabled account - SubjectuserName is the user who performed the action.

Try this to test:

source=wineventlog:security EventID=4725|eval message="User ".TargetUserName." was disabled by ".SubjectUserName|table _time message

[nickhills]

I should just note that you want to run this against your Domain Controller security events, rather than workstations etc.