Splunk Search

How does Active Directory Monitoring Work?

kholleran
Communicator

Hello,

I set up Active Directory monitoring with Splunk a couple weeks ago. I am running a search that searches for Computer objects and returning those with a last login time greater than six months ago.

It is returning what Splunk sees for this, but for some reason, it is only returning a few objects (10 actually) and I am certain that there should be more computer objects out there that are old and need to be purged from our AD.

So my question is, does it only load events that occur in AD or when I set it up does it automatically load the whole AD tree?

Thanks.

Kevin

Tags (2)
0 Karma

sdwilkerson
Contributor

This appears to be fixed now (according to the documentation) and a test I did yesterday shows that well more than 1000 objects was returned on the initial query. I have not verified that all objects were returned, but so far, so good.

http://www.splunk.com/base/Documentation/4.1.7/ReleaseNotes/4.1.6

mpatnode
Path Finder

There are some bugs in admon.exe (for instance it only reads 1000 objects at startup). I've reported a couple of them and hopefully they'll be fixed in the next release.

cramasta
Builder

Hi,

I am also noticing some of the same behavior with the AD monitor. Splunk only sees user objects that were created or updated after the ad monitor was deployed. All my inactive users are not found in a search. It really would be nice to be able to capture everything when the AD agent is first deployed.

-Joe

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...