Active Directory - Finding if an account is enabled

[kholleran]

Hello,

I am monitoring Active Directory with Splunk and have two questions:

1.) How do I format time in a search? I need to report on a specific user sets last logon time but it keeps returning in msecs (?). How can I do in search time formatting? I am actually having this issue across a couple searches and not just with the AD LastLogon.

2.) Is there a way to find the status of a specific user account? We have vendor accounts that a third party can use to get into some systems that they service, however, the accounts are disabled until they contact a proper person to enable them. I would like to run a report and return the status of the accounts every morning or list the accounts that are enabled. Is there a way to glean this from the AD data that Splunk monitors?

Thanks for your time and help.

Kevin

[bojanz]

Is there a reason why you don't pull this data out of Event logs instead of monitoring AD?

In Event logs, you will easily see when the user logged in last time. Regarding enabled accounts, check EventCode 626 on Windows 2003 or EventCode 4722 on Windows 2008. Splunk will automatically extract these Event codes, so a search such as this one:

index=windows EventCode=626 OR EventCode=4722

will print all enabled accounts.

[gkanapathy]

The time format is possibly in Microsoft Ticks (and if you post examples we can verify), which you can convert with:

... | eval epochlogintime = (logintime-621355968000000000)/10000000
    | eval readabletime = strptime(epochlogintime,"%y-%m-%d %H:%M:%S)

As for the second question, you probably need to look at the AD field userAccountControl. This field is a bitmask field. We don't have bitwise operations in Splunk search language, but the disabled bit is 0x2 (or bit 2), so you can do:

... | eval isDisabled = if((userAccountControl%4)>=2),"disabled","enabled")

[insomniacnerd94]

You forgot another opening parenthesis:

your base search ... | eval isDisabled = if(((userAccountControl%4)>=2),"disabled","enabled")