How to search for the every user that has been disabled in the last thirty days on AD

[curlly88]

I'm tasked with searching for all users that have been disabled in the last thirty days, these are employees no longer in the company (cessation), to ensure that out IT matches the payroll and no one that doesn't work here anymore has access still .

[gcusello]

Hi @curlly88,
the EventCode per user disabled is 4725, so you can run a simple search

index=wineventlog EventCode=4725
| dedup Account_name
| dedup Account_name
| table Account_name

Maybe in your windows the field name could be different.

But probably it could be better for you to list all the user name anche check if someone should be disabled and he isn't.
E.g. you could insert in a lookup (called e.g. user_check.csv) all the employees no longer in the company (cessation) in the last 30 days and run something like this:

 index=wineventlog EventCode=4624 [ | inputlookup user_check.csv | fields Account_name ]
| dedup Account_name
| dedup Account_name
| table Account_name

To understand if someone that should be disabled is still accessing your domain.

Ciao.
Giuseppe