Splunk Enterprise

Active Directory Credentials- How do I prevent AD disabling accounts?

dglass0215
Path Finder

Hello,

My Splunk environment is integrated with Active Directory for Logins per DoD STIG Requirement.  However one of the Active Directory STIGs requires AD accounts to be disabled if not logged in the past 30 days.  And it does not seem that logging in via Splunk notifies AD that the user has logged in.  Please help as I have certain users that only login via the Splunk UI and every month AD is disabling their accounts.

Thanks

David

Labels (1)
0 Karma

dglass0215
Path Finder

Surprised that I have not received a response.  Is this not the right place for this type of question?  And if not, can someone point me to where I might get a better reply?

Thanks

David

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...