Splunk Search
Highlighted

How to search for the every user that has been disabled in the last thirty days on AD

New Member

I'm tasked with searching for all users that have been disabled in the last thirty days, these are employees no longer in the company (cessation), to ensure that out IT matches the payroll and no one that doesn't work here anymore has access still .

0 Karma
Highlighted

Re: How to search for the every user that has been disabled in the last thirty days on AD

Legend

Hi @curlly88,
the EventCode per user disabled is 4725, so you can run a simple search

index=wineventlog EventCode=4725
| dedup Account_name
| dedup Account_name
| table Account_name

Maybe in your windows the field name could be different.

But probably it could be better for you to list all the user name anche check if someone should be disabled and he isn't.
E.g. you could insert in a lookup (called e.g. user_check.csv) all the employees no longer in the company (cessation) in the last 30 days and run something like this:

 index=wineventlog EventCode=4624 [ | inputlookup user_check.csv | fields Account_name ]
| dedup Account_name
| dedup Account_name
| table Account_name

To understand if someone that should be disabled is still accessing your domain.

Ciao.
Giuseppe

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.