Splunk Search

Best query to check who modified an AD group

sebasu
New Member

smtp address for the AD group was changed by an admin.Would like to check who made the changes in AD by renaming the AD group or the smtp address.

Tags (1)
0 Karma

adonio
Ultra Champion

hello there,
i think its being captures in Windows Event Codes 4732 - 4738
read here:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4738
capture it in splunk and modify your search accordingly

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...