Account Enabled in Windows

The following Splunk queries will show any accounts that have been enabled from a previously disabled state.

Ensure the Splunk App for Windows is installed grab it here: https://apps.splunk.com/app/742/

Windows Server 2008 and Newer:

Windows Server 2003 and Older:

 

Share This:

Leave A Comment?