All Apps and Add-ons

Feature Suggestion - Splunk Windows TA app - WMI:UserAccounts

danielansell
Path Finder

I recently enabled the WMI:UserAccounts stanza in the wmi.conf of the Windows TA app and found that the WMI:UserAccounts stanza is pulling from the Win32_Accounts class rather than the Win32_UserAccounts class. Pulling from the Win32_Accounts class pulls in all the built-in Windows classes such as "Local Accounts", "Authenticated Users", CREATOR GROUP" amongst a slew of others.

I don't know about everyone else, but I was looking specifically for the entries that show up I type "net user" at the command prompt, or view the Users directory under Local Users and Groups in computer management.

Finally, for what its worth, when using the Win32_Accounts class, I had to create an entry in my props.conf to properly extract the Name field for accounts that contained spaces.

The version of the app I'm using is 4.8.3.

0 Karma

danielansell
Path Finder

If anyone else is curious, I was able to simply change the WMI:UserAccounts stanza from Win32_Accounts to Win32_UserAccounts and get the results I expected.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...