Splunk Search

How to search for the every user that has been disabled in the last thirty days on AD

curlly88
New Member

I'm tasked with searching for all users that have been disabled in the last thirty days, these are employees no longer in the company (cessation), to ensure that out IT matches the payroll and no one that doesn't work here anymore has access still .

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @curlly88,
the EventCode per user disabled is 4725, so you can run a simple search

index=wineventlog EventCode=4725
| dedup Account_name
| dedup Account_name
| table Account_name

Maybe in your windows the field name could be different.

But probably it could be better for you to list all the user name anche check if someone should be disabled and he isn't.
E.g. you could insert in a lookup (called e.g. user_check.csv) all the employees no longer in the company (cessation) in the last 30 days and run something like this:

 index=wineventlog EventCode=4624 [ | inputlookup user_check.csv | fields Account_name ]
| dedup Account_name
| dedup Account_name
| table Account_name

To understand if someone that should be disabled is still accessing your domain.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...