Accounts Disabled WinEventLog:Security ItsJohnLocke 1 1 This query will return results for accounts disabled on a windows 2008 or newer operating system for a given time range: sourcetype=WinEventLog:Security (EventCode=4725) | stats count by index, user, host, name 1 sourcetype=WinEventLog:Security (EventCode=4725) | stats count by index, user, host, name Share This: Tagged: accounts disabledWindows Security
