Short Lived Windows Accounts

Description

This search detects accounts that were created and deleted in a short time period.

   Help

Short Lived Windows Accounts Help

This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/

   Search

Open in Search