Check for event that has not changed for X days

[Branden]

Hello.

I'm struggling with a query. We want to search Windows Event logs for accounts whose passwords have not been changed (by admins) for more than 700 days. I have created a query that informs me of when a password was changed:

 index=main host=*DC* EventCode=4724 | eval Modifier = mvindex(Account_Name, 0) | eval User_Name = mvindex(Account_Name, 1) | rename Group_Name AS Modified_Group | table _time Modifier User_Name

But I do not know how to get Splunk to check for a password that has NOT been changed for over X days. Is this even possible?

Thank you in advance for your help.

[ololdach · Accepted solution]

Hi Branden,

I think the answer is quite easy, but not what you expect:
- Install the SA-ldapsearch (Splunk Supporting Add On for Active Directory) https://splunkbase.splunk.com/app/1151/
- do an LDAP-Search on your tree and look for (objectClass=shadowAccount) and the field shadowLastChange (date of last password change)

Hope it helps
Oliver

[Branden]

Thank you for your response. We have an AD environment and a separate LDAP environment (running on Linux). Your solution would work for our LDAP logs, but for AD all I have to go by are the Windows Event Logs.

[ololdach]

Hi Branden, the solution works fine with AD, provided you get a read-only AD user set up in your AD domain. If you can't get access, though, this page tells you the right messages to get into splunk and look for: https://blogs.manageengine.com/active-directory/2018/08/23/monitoring-service-account-password-chang...
Best
Oliver

[Branden]

You were absolutely right. I misunderstood what you were saying.
I worked with one of our admins and we have the query working. You're right - it's quite an easy solution. Thank you very much!