How does Active Directory Monitoring Work?

[kholleran]

Hello,

I set up Active Directory monitoring with Splunk a couple weeks ago. I am running a search that searches for Computer objects and returning those with a last login time greater than six months ago.

It is returning what Splunk sees for this, but for some reason, it is only returning a few objects (10 actually) and I am certain that there should be more computer objects out there that are old and need to be purged from our AD.

So my question is, does it only load events that occur in AD or when I set it up does it automatically load the whole AD tree?

Thanks.

Kevin

[sdwilkerson]

This appears to be fixed now (according to the documentation) and a test I did yesterday shows that well more than 1000 objects was returned on the initial query. I have not verified that all objects were returned, but so far, so good.

http://www.splunk.com/base/Documentation/4.1.7/ReleaseNotes/4.1.6

[mpatnode]

There are some bugs in admon.exe (for instance it only reads 1000 objects at startup). I've reported a couple of them and hopefully they'll be fixed in the next release.

[cramasta]

Hi,

I am also noticing some of the same behavior with the AD monitor. Splunk only sees user objects that were created or updated after the ad monitor was deployed. All my inactive users are not found in a search. It really would be nice to be able to capture everything when the AD agent is first deployed.

-Joe