Splunk Search

Check for event that has not changed for X days

Branden
Builder

Hello.

I'm struggling with a query. We want to search Windows Event logs for accounts whose passwords have not been changed (by admins) for more than 700 days. I have created a query that informs me of when a password was changed:

 index=main host=*DC* EventCode=4724 | eval Modifier = mvindex(Account_Name, 0) | eval User_Name = mvindex(Account_Name, 1) | rename Group_Name AS Modified_Group | table _time Modifier User_Name

But I do not know how to get Splunk to check for a password that has NOT been changed for over X days. Is this even possible?

Thank you in advance for your help.

0 Karma
1 Solution

ololdach
Builder

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

View solution in original post

ololdach
Builder

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

Branden
Builder

Thank you for your response. We have an AD environment and a separate LDAP environment (running on Linux). Your solution would work for our LDAP logs, but for AD all I have to go by are the Windows Event Logs.

0 Karma

ololdach
Builder

Hi Branden, the solution works fine with AD, provided you get a read-only AD user set up in your AD domain. If you can't get access, though, this page tells you the right messages to get into splunk and look for: https://blogs.manageengine.com/active-directory/2018/08/23/monitoring-service-account-password-chang...
Best
Oliver

0 Karma

Branden
Builder

You were absolutely right. I misunderstood what you were saying.
I worked with one of our admins and we have the query working. You're right - it's quite an easy solution. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...