All Apps and Add-ons

The SA-ldapsearch - Splunk Supporting Add-on for Active Directory does not show all users in the domain admins group.


I'm trying to create a report/dashboard that will show all users in the domain admins group, the query below does work and will create a report but the report is also missing users inside of the domain admins group. The users that are missing have their primary group set to domain admins.(This could be the issue) or a bug that inside of the Splunk Supporting Add-on for Active Directory. Any ideas?

| ldapsearch domain="domain" search="(&(objectclass=group)(cn=Domain Admins))"|fields *
| ldapgroup
| table member_name,member_type,member_dn
| sort member_name
| rename member_name as "Username",member_type as "Membership Type"
| search (Username !="" OR member_domain !="" OR Domain !="")

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...