Hello guys,
I have a question about a query search. I have two queries associated with Windows.
My first query is:
"EventCode=624" "Message="User Account Created"" | table _time New_Account_Name Caller_User_Name
Second query is:
EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled" | table Target_Account_Name Caller_User_Name _time
My problem is: When my costumer create a new account in Active Directory, it is creates two events - the First event is "624" - "User Account Created", and the other event is "642" "User Account Enable". So, I just need to visualize only ENABLE accounts (EVENT 642),when it is enable(not create) an account in AD.
The _time field is equal in both events, because these events are created simultaneously.
Thanks,
DF
As far as I understand the requirement, there are two scenario
Where a new account is created, two events (with same timestamp) is written
EventCode=624 Message="User Account Created"
and
EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled"
When an account is enabled (just enable, not create), one event is written
EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled"
and what you wish is the create table for events created for scenario 2 (account enable only)
If this is correct, you can use following.
(EventCode=624 Message="User Account Created") OR (EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled" ) | rename New_Account_Name as Account_Name | rename Target_Account_Name as Account_Name| stats count by Account_Name, Caller_User_Name,_time | where count=1
This might work. Maybe. The dedup command will choose the most recent event, so I’m not sure what will happen if both events have the same time – order of search discovery perhaps?
EventCode=642 OR EventCode=624 | search Message="*User Account Changed*" OR Message="*User Account Control*" OR Message="*Account Enabled*" OR Message="*User Account Created*" | dedup _time | table Target_Account_Name Caller_User_Name _time