SPL
Accounts Disabled
Description
This query will return results for accounts disabled on a windows 2008 or newer operating system for a given time range:
1 1
sourcetype=WinEventLog:Security (EventCode=4725) | stats count by index, user, host, name
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.