SPL
Accounts Enabled
Description
This query will return results on all accounts enabled for a given time range. It is using EventCodes for windows 2008 and newer operating systems:
0 0
sourcetype=WinEventLog:Security (EventCode=4722) | stats count by index, user, host, name
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.