Getting Data In

Active Directory Lockout alerts

jared_anderson
Path Finder

I have active directory sending logs to my Splunk server via a Universal forwarder. I want to create alerts for when a user locks themselves out of Active Directory. What is the best way to do this?

Tags (1)
0 Karma

jan_wohlers
Path Finder

EventCode=4740 host=* --> This will show you all lock out events occuring. "Caller Name" ist the server/System from where the lockout comes from

jared_anderson
Path Finder

I think the problem I have is that we have multiple domain controllers, and the forwarder isn't on the main one. So I don't get the actual lockout event, just the replication across the DCs

0 Karma

mbenwell
Communicator

Look at the Active Directory App. As part of this app you will get all sorts of field extractions, dashboards and eventtypes (including one for account lockouts).

So... then just search for the eventtype:

eventtype=msad-account-lockout

0 Karma

stephennbh
New Member

How could I run this search against my whole domain for all the domain controllers instead of one DC host?

0 Karma

kristian_kolb
Ultra Champion

Assuming that you have the security log in splunk, the following search would probably work

sourcetype=wineventlog:security host=<your domain controller> Failure_Reason="Account locked out." | eval acc=mvindex(Account_Name,1)| table _time acc 

This gives you a list of anyone trying to log in with a locked account. Set up a scheduled search, and report when number of results is > 0.

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

Hmm, yes, I think that this event will be generated the when the account gets locked as well.

0 Karma

jared_anderson
Path Finder

would this only work if they tried to log in when they were already locked out? If they locked the account out, then never tried to log in again, would this report find anything?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...