Short Lived Windows Accounts


This search detects accounts that were created and deleted in a short time period.


Short Lived Windows Accounts Help

This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here:


Open in Search