Hello,
My Splunk environment is integrated with Active Directory for Logins per DoD STIG Requirement. However one of the Active Directory STIGs requires AD accounts to be disabled if not logged in the past 30 days. And it does not seem that logging in via Splunk notifies AD that the user has logged in. Please help as I have certain users that only login via the Splunk UI and every month AD is disabling their accounts.
Thanks
David
Surprised that I have not received a response. Is this not the right place for this type of question? And if not, can someone point me to where I might get a better reply?
Thanks
David