Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Issues with Splunk App for AD and Group policy changes not being listed

$
0
0

The group policy audit does not show changes made to gpo's. I have two domain controllers in a forest, one serving the root domain and the other serving a subdomain. The Splunk App for AD uses event 4662 which has embedded an Object Type and Object Name which is used in the following search macro:

eventtype=msad-ad-access Object_Type="groupPolicyContainer" | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | stats count values(Object_Name) by host

On one domain controller, the Object Type is properly stored on the indexer as groupPolicyContainer thus this search works properly. The Object Name is also correct. The other domain controller is sending just hex codes for the Object Type and Object Name, ie instead of the following entry

Object Type: groupPolicyContainer
Object Name: CN={135A1F9B-BECD-40CB-AA3E-FE24D39269A9}CN=Policies,CN=System,DC=na,DC=globomantics,DC=local

Instead it looks as follow:

Object Type:        %{19195a5b-6da0-11d0-afd3-00c04fd930c9}
Object Name:        %{b180120c-b7b5-4e90-bbe8-9def8d9492db}

This issue is very similar to a question asked "Splunk">http://splunk-base.splunk.com/answers/74609/splunk-for-ad-group-policy-changes-query">"Splunk for AD - Group Policy Changes Query

I am reasking the question because I wonder if I have misconfigured the windows server resulting in just hex being sent to the indexer and not a bug in the AD app.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>