Getting Data In

Splunk 6.1 how to find a listing of local admins on all workstations and servers

tbalouch
Path Finder

Hey guys,

I was wondering if there is a search that would list all local admin accounts on a workstation or server in my windows domain?

Tags (3)
0 Karma
1 Solution

tbalouch
Path Finder

Thanks that looks like it works. But how would I output this to a file? Can i create a new file in the Splunk forwarder directory on the remote server?

0 Karma

lukejadamec
Super Champion

You would need to monitor an output that contains the list of local admins, and that does not happen automatically on Windows systems.

You could create a script to run on a schedule that generates a list of local admins, and read that data into Splunk. The command to run in the script would be this I think:
net localgroup administrators

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...