Splunk Search

How to search Windows event logs for the "creator" of a new Active Directory account?

apantoja
New Member

We are running some automated reports that give us information on accounts created in the last 24 hours.

index=wineventlog EventCode=4720 OR "A user account was created" | table _time Computer_Name Account_Domain Account_Name Display_Name | sort -_time

What I can't seem to find is a Windows event ID that includes a "creator" of the account. Is this something someone has found? or just is not possible? It's nice to get a report on what new accounts were created, but it would be nice to see WHO created the accounts.

Thanks in advance for any information!

0 Karma

dshpritz
SplunkTrust
SplunkTrust

I know this is late, but it could help others:

If you have the Splunk Add-on for Windows installed, you will get two fields when looking at 4720 events, the user and the src_user. In the context of this event, the src_user is the user creating the account and the user is the user being created.

Note that per the Common Information Model, this isn't correct, and you would expect the user to be the user creating the action and the user being created should be in a field named object. So, in this case, the TA is incorrect.

HTH,

Dave

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...