All Apps and Add-ons

Splunk App for Windows Infrastructure: How to find all inactive accounts in my domains along with last logon/activity time?

msaz
Path Finder

I'm using the Splunk App for Windows Infrastructure and it's working and returning data. I want to find all inactive accounts in my domains along with last logon/activity time. The 'Domain Accounts: Inactive' report driven by 'secrpt-inactive-users' lists user accounts, but doesn't show last logon/time of activity. How can I also list last logon/activity time?

0 Karma

BenTan
Path Finder

Hi,

In order for dashboards under Active Directory section to work well, you will need to install additional Add-On namely the Splunk Add-on for Microsoft Active Directory and Splunk Add-on for PowerShell. You might need the Splunk Add-on for Windows DNS if you are interested in collecting DNS related logs.

You can follow the official documentation here to help you:
https://docs.splunk.com/Documentation/MSApp/1.4.2/MSInfra/AbouttheSplunkAppforMSInfrastructure

Regards,
Benjamin

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...