Splunk Search

How does Active Directory Monitoring Work?

kholleran
Communicator

Hello,

I set up Active Directory monitoring with Splunk a couple weeks ago. I am running a search that searches for Computer objects and returning those with a last login time greater than six months ago.

It is returning what Splunk sees for this, but for some reason, it is only returning a few objects (10 actually) and I am certain that there should be more computer objects out there that are old and need to be purged from our AD.

So my question is, does it only load events that occur in AD or when I set it up does it automatically load the whole AD tree?

Thanks.

Kevin

Tags (2)
0 Karma

sdwilkerson
Contributor

This appears to be fixed now (according to the documentation) and a test I did yesterday shows that well more than 1000 objects was returned on the initial query. I have not verified that all objects were returned, but so far, so good.

http://www.splunk.com/base/Documentation/4.1.7/ReleaseNotes/4.1.6

mpatnode
Path Finder

There are some bugs in admon.exe (for instance it only reads 1000 objects at startup). I've reported a couple of them and hopefully they'll be fixed in the next release.

cramasta
Builder

Hi,

I am also noticing some of the same behavior with the AD monitor. Splunk only sees user objects that were created or updated after the ad monitor was deployed. All my inactive users are not found in a search. It really would be nice to be able to capture everything when the AD agent is first deployed.

-Joe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...