–A–

Active Directory user, show recent changes

Below is intended to discover who might have disabled, enabled, or deleted a user but excludes event IDs 4768, 4769, 4770 Kerberos requests and renewals to filter out noise

index=* dontDeleteMe earliest=06/09/2026:00:00:00
| search EventCode!=4770 EventCode!=4769 EventCode!=4768
| table _time user src_user Account_Name TargetUserName action EventCode signature Message
| sort - _time

Active Directory users, show recent OU moves

index=* sourcetype="XmlWinEventLog" EventCode=5139 "W30188"
| table _time, SubjectUserName, SubjectUserSid, ObjectDN, OldObjectDN, NewObjectDN

–B–

–C–

–D–

–E–

–F–

–G–

–H–

–I–

–J–

–K–

–L–

–M–

–N–

NTLM V1

many of these are bogus/not important because the Account Name field of event 4624 records is ANONYMOUS LOGON. We’re only interested in domain users, so specify your domain. This seems to be the easiest way to screen out ANONYMOUS LOGON

list Events ID 4624 records meeting criteria

EventCode=4624 "Package Name (NTLM only): NTLM V1" Account_Domain="yourdomain"

download accounts with count for each to export

EventCode=4624 "Package Name (NTLM only): NTLM V1" Account_Domain="yourdomain" | stats count by Account_Name

–O–

OU moves show recent Active Directory users whose OU was changed – see Active Directory users, show recent OU moves

–P–

–Q–

–R–

–S–

–T–

–U–

user, show recent changes – see Active Directory user, show recent changes

–V–

–W–

–X–

–Y–

–Z–