Finding when a set of AD users were disabled.

Splunk Search

Hello,

I am trying to figure out how to find when a set of users were disabled in AD. We have the app MS Windows AD Objects installed in our environment and it doesn't seem to have the search I am looking for.
Looking if someone out there who already have a report like this?

Thank you,

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...