Need last logon for a user

[chrodriguez]

Need to know what was the last time a domain AD account “username” was logged into and from what server/machine please?

[nwuest · Accepted solution]

Hi @chrodriguez,

So you are specifically looking for the account "wmsadmin", which is disabled to see the last time that it was used to log in?

Have you been collecting logs in your environment with splunk forwarders since "9/20/2011" the date of the lastLogonTimestamp?

• If you have had splunk forwarders collecting events for that long, what is your retention policy with frozen buckets?
• If not, you can try to kickoff an event with 'enabling that account, logging in-and-out with it then disabling the account'.
  Then you should see some activity in your searchhead so that search will return some results.

Let us know what happens!

V/R,
nwuest

[chrodriguez]

thanks for the insight, I completely forgot that we have only had splunk introduced since 2016. So thats why its not populating data from 2011.

[chrodriguez]

That doesn't return anything, I really need to focus on "A User" not just everything. I ran this, and it returned nothing for the account but then when I try against my user account it does return data. The account wmsadmin is indeed an actual user account that is disabled and the "lastLogonTimestamp" has a value or date of 9/20/2011.

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin")
| eval day=strftime(_time,"%d/%m/%Y")
| stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

[nwuest]

Hi @chrodriguez 

Try this:

EventCode=4624 | dedup ComputerName | table ComputerName _time

View solution in original post 

Let us know if this works for you

V/R,
nwuest

[chrodriguez]

That doesn't return anything, I really need to focus on "A User" not just everything. I ran this, and it returned nothing for the account but then when I try against my user account it does return data. The account wmsadmin is indeed an actual user account that is disabled and the "lastLogonTimestamp" has a value or date of 9/20/2011. index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634 "wmsadmin") | eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day | eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")