All domain controllers are sending the event code 644 & 4740 to windowseventlog index.
Using the search below I am able to determine the accounts locked out - As result the search provide the account name locked-out
As account name I have the DomainController$ and users name - I can't use =!DomainControler$ to display only the user name because also the users name related will be omitted -
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | timechart span=1h count by Account_Name
Both are working well - Thanks a lot
Try this.
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous
| eval Account_Name = mvindex(Account_Name,1)
| eval Security_ID = mvindex(Security_ID,1)
| timechart span=1h count by Account_Name
Just because im not a fan of timechart, this one will show you where the account was locked. This assumes Caller_Computer_Name is a valid field for you. Security_ID is redundant if you only have one domain.
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous
| eval Account_Name = mvindex(Account_Name,1)
| eval Security_ID = mvindex(Security_ID,1)
|stats count(Account_Name) as COUNT by Account_Name Security_ID Caller_Computer_Name
-JD
Can you restate your question. Are you wanting to remove the domain name from the Account_Name field and keep only the user name or do you want to exclude events that have only the domain name? Also, can you share a couple of sample events
Hi, I am trying to explain myself better - In the raw data I have for a single event as Account_Name the userid and the DCx$
Account_Name = DC1$ Account_Name J.smith EventCode 4740
Account_Name = DC1$ Account_Name p.brown EventCode 4740
Account_Name = DC2$ Account_Name p.brown EventCode 4740
as search result using stats by Account Name
DC1$ = 2
J.smith = 1
DC2$ = 1
p.brown = 2
What I'm looking for :
j.smith = 1
p.brown = 2
Thank you in advance for the attention given