Splunk Search

How do you identify all accounts not automatically locked after 5 consecutive failed log in attempts?

Path Finder

I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts

Please help with the query

Thanks,
Sahil

0 Karma
1 Solution

SplunkTrust
SplunkTrust

When an account gets locked out, Active Directory sends out EventCode=4740. So, if you are indexing AD security logs, you could check for lock-outs using

index=wineventlog EventCode=4740 Account_Name=* ..... shows all locked accounts.

index=msad | timechart span=5m sum(badPwdCount) AS total by sAMAccountName ... gives count of lockouts for each user.

So, you can run the 2nd search to check for lockout counts and check if you have a 4740 event for that user. If there is no record, that could potentially indicate an account not getting locked out.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

When an account gets locked out, Active Directory sends out EventCode=4740. So, if you are indexing AD security logs, you could check for lock-outs using

index=wineventlog EventCode=4740 Account_Name=* ..... shows all locked accounts.

index=msad | timechart span=5m sum(badPwdCount) AS total by sAMAccountName ... gives count of lockouts for each user.

So, you can run the 2nd search to check for lockout counts and check if you have a 4740 event for that user. If there is no record, that could potentially indicate an account not getting locked out.

View solution in original post

0 Karma

Path Finder

I checked Above query but not worked , Can you give me proper query so that I can test, May be query is right but some argument is missing.

Thanks,
Sahil

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!