Hi Nahra, I went ahead and did what you suggested, so for the the one that is working you can see it in the screenshot: `admon-group-lookup-update' The search commands for the two panels in the 'Group Changes' AD search are very different from the report version I think this is because there is much more detail in terms of what members were added/removed: eventtype=msad-group-changes (host="") user_group="" MSADGroupType="" MSADGroupClass=""|eval adminuser=src_nt_domain."\".src_user|search adminuser="*"|table _time,adminuser,msad_action,MSADGroupClass,MSADGroupType,src_nt_domain,user_group|rename adminuser as "Administrator",msad_action as "Action",user_group as "Group", MSADGroupClass as "Type", MSADGroupType as "Scope",src_nt_domain as "Domain" This one is for the "Group Changes" panel eventtype=msad-groupmembership-changes (host="") user_group="" MSADGroupType="" MSADGroupClass="" member="" | eval adminuser=src_nt_domain."\".src_user | search adminuser="" | table _time,adminuser,MSADGroupClass,MSADGroupType,src_nt_domain,user_group,msad_action,member | rename adminuser as "Administrator",MSADGroupClass as "Type",MSADGroupType as "Scope",src_nt_domain as "Domain",user_group as "Group",msad_action as "Action",member as "Member" This one is for the "Membership Changes" panel I also looked up the eventtype=msad-groupmembership-changes and eventtype=msad-group-changes and confirmed those event types do exist as well. I performed searches based on those event IDs too and was able to pull data. ... View more

Thank you for your reply. So after you said that this was a Windows TA I thought of the Splunk App for Windows. Low and behold the app is disabled. I believe I disabled this app because it is incompatible with the Splunk App for Windows Infrastructure (even though Splunk says that the Splunk App for Windows Infrastructure v.1.5.1 is compatible with Splunk App for Windows v 5.0 and later). I went on a whim and enabled the Splunk App for Windows again. However after doing this I got the error: Could not load lookup=LOOKUP-app4_for_windows_security After looking at this for a bit most of the past answers involved disabling the Splunk App for Windows which leads me back to square 1. I tried upgrading the Splunk App for Windows Infrastructure to v. 1.5.2 but getting errors doing so. ... View more

Again I do not know what I am looking for in this extensive log. I see a bunch of lines like this 06-11-2019 12:42:08.685 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=7 AppEvents from DC ip=10.101.201.4 name=EA8EBD62-4291-44AB-BD9C-DE50036B75BF 06-11-2019 12:42:09.376 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=7 AppEvents from DC ip=10.102.201.3 name=757FF50E-A587-4ADD-8C7A-3DF94FE6A3D9 06-11-2019 12:42:38.508 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=3 AppEvents from DC ip=10.102.204.1 name=F3273119-1099-4842-9D5D-0794B2CBE9B1 06-11-2019 12:42:38.784 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=3 AppEvents from DC ip=10.101.204.2 name=8DB575D9-937A-4BD8-B8A7-71C964BD9FBF 06-11-2019 12:44:14.292 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=7 AppEvents from DC ip=10.102.201.4 name=B1285E03-0720-4A53-BFF4-F52C17BBC4D3 06-11-2019 12:44:43.722 -0400 INFO ClientSessionsManager:Listener_AppEvents - Received count=3 AppEvents from DC ip=10.101.204.3 name=CD69ADA1-AE46-4551-A27D-6975F3694934 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" Get-Item : Cannot find path 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" 'HKLM:\System\CurrentControlSet\Services\NTDS\Parameters' because it does not 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" exist. 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" At C:\Program 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\powershell\nt6-health.ps1:66 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" char:15 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" + $SchemaInfo = Get-Item 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" "HKLM:System\CurrentControlSet\Services\NTDS\Parameters" 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" + 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" + CategoryInfo : ObjectNotFound: (HKLM:\System\Cu...NTDS\Paramete 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" rs:String) [Get-Item], ItemNotFoundException 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetIt 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" emCommand 06-11-2019 12:44:54.706 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" 06-11-2019 12:44:54.711 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_ad\bin\runpowershell.cmd" nt6-health.ps1" You cannot call a method on a null-valued expression. Does this mean anything to you? ... View more

@woodcock So I did that from one of the other clients and the License server and got the certificate thumbprint and the other details which should signify a successful connection using SSL/TLS So this means there shouldn't be a communication issue right? ... View more

Yeah I entered that query and received over 320,000+ events...I think that's a little much don't you think? I tried using the "Interesting fields" options on the left to group "deploy-server" but that still yielded 10,000+ events just for today I think. Anything in particular I'm looking for? ... View more

Well I did that and it is still showing the same status. And yes I stopped and started the Splunk service ... View more

Sorry but is there a specific area I am looking for in this log? Also is the one you're referring to in the \var\log directory? ... View more

Am I doing the "Reset All Settings" on the Deployment Server? That'll remove all of the Forward Management and all that stuff correct? ... View more