Splunk Search

Account locked

SN1
Path Finder

there is a user lets say ABC and I want to check why his AD account is locked .

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What information do you have available to you to help you determine this?

0 Karma

SN1
Path Finder

there is a user , he is saying his account is locked i want to check using splunk what is the cause how can i do that

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What information do you have in Splunk? Which system is the user locked out of?

0 Karma

SN1
Path Finder

His AD account , windows system

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It depends on what information you have ingested into your Splunk environment.

Splunk is "just" a data processing tool. You have to feed it with data. If you have your AD logs in Splunk, you can search them but while there might be some people around here who have more experience with MS systems, it's generally more of a AD-related question how to find that info than it is a Splunk Question. You must know what to look for.

If your data is properly onboarded and CIM-compliant, you can look through Change datamodel (if I remember the syntax correctly)

| datamodel Change Account_Management.Locked_Accounts | search user="whatever"

 I'm not sure though if it will only find the lockout event as such or will it contain the reason as well.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK, so what information do you have in Splunk?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...